Ethical Hacking News
PHP has warned of another unpatched Remote Code Execution (RCE) vulnerability, CVE-2026-115560, which affects only web applications configured in an unusual way. Learn more about the risks and mitigation strategies to prevent potential attacks.
PHP has issued a warning about a new unpatched Remote Code Execution (RCE) vulnerability, CVE-2026-115560. The vulnerability affects only web applications configured in an unusual way and is considered an unlikely risk. The issue can occur when a web application sets a specific option and makes changes before calling session_start(). PHP recommends setting a specific option to prevent potential attacks. Only a narrow setup is at risk, and no exploitation of CVE-2026-115560 has been reported.
PHP, a widely used server-side scripting language, has issued a warning about another unpatched Remote Code Execution (RCE) vulnerability, just two days after releasing emergency patches for the critical PHP2Shell flaws. This latest warning, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. However, it is essential to understand the implications of this new vulnerability and the necessary mitigation strategies to prevent potential attacks.
The PHP warning, published on October 23, 2026, informs developers and administrators of a new vulnerability that could allow an attacker to run code on a web server. The vulnerability is separate from the two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The new issue is not fixed by these releases and is considered an unlikely risk due to its narrow setup.
To understand the vulnerability, it is crucial to know the specific conditions that trigger the issue. PHP states that the problem can occur when a web application sets the `session.serialize_handler` option to `php_binary` or `php_serialize`, then changes that option to `php` while running by calling `ini_set()`, and makes that change before it calls `session_start()`. Additionally, session upload progress must still be turned on. PHP recommends setting `session.upload_progress.enabled=0` until the next routine bugfix release as a mitigation strategy.
It is worth noting that only a narrow setup is at risk, and PHP believes that the problem is unlikely in practice. However, it is still essential to take this warning seriously and apply the recommended mitigation strategy to prevent potential attacks.
The PHP warning also mentions that no exploitation of CVE-2026-115560 has been reported, and attacks reported since October 21 target the two earlier PHP2Shell flaws. However, attempts to exploit the two earlier PHP2Shell flaws have surged, with Amazon's honeypots logging an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days before the flaws were disclosed.
In summary, PHP has warned of another unpatched RCE, CVE-2026-115560, which affects only web applications configured in an unusual way. While PHP considers it an unlikely risk, it is essential to apply the recommended mitigation strategy to prevent potential attacks. Developers and administrators should take this warning seriously and ensure that their web applications are secure against this new vulnerability.
PHP has warned of another unpatched Remote Code Execution (RCE) vulnerability, CVE-2026-115560, which affects only web applications configured in an unusual way. Learn more about the risks and mitigation strategies to prevent potential attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/PHP-Warns-of-Another-Unpatched-RCE-Understanding-the-Risks-and-Mitigation-Strategies-ehn.shtml
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
Published: Fri Oct 23 09:20:52 2026 by llama3.2 3B Q4_K_M
