Ethical Hacking News
PHP has warned of another unpatched RCE risk two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way. Although considered an unlikely risk, PHP recommends turning off a feature called session upload progress until a fix is available in the next routine release. This comes after the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server.
PHP has issued a new warning for an unpatched Remote Code Execution (RCE) risk, CVE-2026-115560. The issue is considered unlikely and affects web applications configured in a specific way. The PHP team recommends turning off the session upload progress feature until a fix is available. The issue is separate from the earlier PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which were patched on October 21. No exploitation of CVE-2026-115560 has been reported, but attempts to exploit the two earlier PHP2Shell flaws have surged.
PHP, a widely used open-source scripting language, has issued a new warning regarding an unpatched Remote Code Execution (RCE) risk just two days after shipping emergency patches for the critical PHP2Shell vulnerabilities. The latest issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way and is considered an unlikely risk by PHP.
The warning came in a short informational advisory published on October 23, 2026, which recommended turning off a feature called session upload progress until a fix is available in the next routine release. This is the same setting PHP already listed as a mitigation in its October 21 advisory for CVE-2026-109619.
The new issue is separate and is not fixed by the releases that patched the two earlier PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Those were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Only a narrow setup is at risk, according to PHP. This can occur when a web application sets the session.serialize_handler option to php_binary or php_serialize in its configuration, then changes that option to php while running by calling ini_set(), and makes that change before it calls session_start(). Session upload progress must also still be turned on.
PHP says the problem can occur when a web application does all of the following: sets the session.serialize_handler option to php_binary or php_serialize in its configuration, then changes that option to php while running by calling ini_set(), and makes that change before it calls session_start(). Session upload progress must also still be turned on. An application that never changes the serialize handler while running can leave the feature on and is not exposed through this path. PHP says this setup is unlikely in practice.
The action is one line. PHP recommends setting session.upload_progress.enabled=0 until the next routine bugfix release. This is the same setting it already listed as a mitigation in the October 21 advisory for CVE-2026-109619. Anyone who applied it then and left it in place needs to do nothing more for the new issue. Session upload progress is turned on by default and lets an application track the progress of a file upload.
Because the setup is uncommon, PHP is handling the fix as part of its regular release cycle rather than as an emergency, and it will publish a full advisory for CVE-2026-115560 with the next release. PHP has not stated which versions are affected, which releases will contain the fix, or a severity score. It also has not said whether the new issue shares a root cause with CVE-2026-109619.
No exploitation of CVE-2026-115560 has been reported; the attacks reported since October 21 target the two earlier PHP2Shell flaws. Separately, attempts to exploit the two earlier PHP2Shell flaws have surged. Amazon said its honeypots logged an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days before the flaws were disclosed, and Cloudflare said attempts rose from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22.
Attackers have tried to use the flaws to install a Mirai botnet variant, according to Sophos and Arctic Wolf. Those attempts have so far failed: Previdian, Wordfence and others report scanning and probing but no confirmed code execution, and researchers say a reliable exploit is proving harder to build than expected. That activity targets the two flaws patched on October 21, not CVE-2026-115560, which has not been reported under attack.
Related Information:
https://www.ethicalhackingnews.com/articles/PHP-Warns-of-Another-Unpatched-RCE-Risk-Following-Emergency-PHP2Shell-Patches-ehn.shtml
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
Published: Fri Oct 23 12:12:20 2026 by llama3.2 3B Q4_K_M
