Ethical Hacking News
PHP has warned of a new, unlikely code execution flaw, just two days after releasing emergency patches for the critical PHP2Shell vulnerabilities. The vulnerability is separate from PHP2Shell and is not fixed by the October 21 updates. PHP recommends disabling session upload progress until a fix is released as a simple temporary mitigation. Despite the new flaw, no confirmed successful exploits have been reported yet.
PHP has issued a warning about a new code execution flaw, CVE-2026-115560. The flaw is unlikely and affects only specific PHP configurations. Applications must meet certain conditions to be vulnerable, including changing the session.serialize_handler. Most applications will not be affected, but PHP recommends disabling session upload progress as a temporary mitigation. The new flaw is separate from PHP2Shell and is not fixed by the October 21 updates. No confirmed successful exploits have been reported yet, but tens of thousands of attempts have been made. The PHP2Shell vulnerabilities have been patched, but attacks continue. The incident highlights the importance of keeping software up to date and following best practices to prevent vulnerabilities.
PHP has issued a warning about a new code execution flaw, just two days after releasing emergency patches for the critical PHP2Shell vulnerabilities. The new flaw, tracked as CVE-2026-115560, is described as an unlikely code execution vulnerability that affects only a specific PHP configuration. According to the PHP advisory, an application must meet certain conditions to be vulnerable to this flaw, including configuring session.serialize_handler to php_binary or php_serialize, changing it to php at runtime using ini_set(), and making this change before calling session_start(). Additionally, session upload progress must be enabled.
The PHP advisory notes that applications that never change the serialization handler at runtime are not exposed through this attack path, even if session upload progress is enabled. This means that most applications will not be affected by this vulnerability. However, PHP recommends disabling session upload progress until a fix is released, as a simple temporary mitigation.
The new flaw is separate from PHP2Shell and is not fixed by the October 21 updates for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. According to Cloudflare researchers, tens of thousands of exploit attempts were made within 45 minutes of public disclosure, with hundreds of thousands within two hours, and millions by October 22. However, no confirmed successful exploits have been reported yet.
The PHP2Shell vulnerabilities, which were patched on October 21, are critical and have been the subject of a significant number of attacks. The vulnerabilities were discovered in 2019, but the attack surface was expanded recently when attackers began using the vulnerabilities to mine cryptocurrency. Despite the significant number of attacks, no successful exploits have been reported yet.
In related news, Meta has been ordered to pay $25 billion in penalties linked to the Cambridge Analytica scandal, INTERPOL has conducted an operation that has resulted in 1,462 arrests and recovered $105 million in cybercrime, and Microsoft has linked a breach of ConnectWise to a China-linked group using an AI pentesting tool.
The recent PHP warning highlights the importance of keeping software up to date and following best practices to prevent vulnerabilities. It also underscores the ongoing threat of cyberattacks and the need for vigilance and proactive measures to protect against these threats.
Related Information:
https://www.ethicalhackingnews.com/articles/PHP-Warns-of-New-Code-Execution-Flaw-Just-Days-After-Patches-for-Critical-Vulnerability-ehn.shtml
https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html
Published: Fri Oct 23 14:19:03 2026 by llama3.2 3B Q4_K_M
