Ethical Hacking News
PHP has issued a warning about another unpatched remote code execution (RCE) vulnerability, just two days after releasing emergency patches for the critical PHP2Shell flaws. The new issue, assigned the CVE-2026-115560 identifier, affects only web applications configured in an unusual manner, and PHP considers it an unlikely risk.
The PHP project has issued a warning about a new unpatched remote code execution (RCE) vulnerability, CVE-2026-115560. The vulnerability is considered unlikely and is only triggered in web applications configured in a specific way. PHP recommends turning off the "session upload progress" feature until a fix is available in the next routine release. The vulnerability can occur when using a specific configuration option, and session upload progress must be enabled. No exploitation of CVE-2026-115560 has been reported, and attempts to exploit the related PHP2Shell flaws have failed so far.
PHP has issued a warning about another unpatched remote code execution (RCE) vulnerability, just two days after releasing emergency patches for the critical PHP2Shell flaws. The new issue, assigned the CVE-2026-115560 identifier, affects only web applications configured in an unusual manner, and PHP considers it an unlikely risk. However, the project is not issuing an emergency fix for it and instead recommends turning off the "session upload progress" feature until a fix is available in the next routine release.
The warning came in a short informational advisory published on October 23, which follows the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Those were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The new issue is separate and is not fixed by those releases.
According to PHP, the problem can occur when a web application sets the "session.serialize_handler" option to "php_binary" or "php_serialize" in its configuration, then changes that option to "php" while running by calling "ini_set()", and makes that change before it calls "session_start()". Session upload progress must also still be turned on. An application that never changes the serialize handler while running can leave the feature on and is not exposed through this path. PHP says this setup is unlikely in practice.
The recommended action is one line: setting "session.upload_progress.enabled=0" until the next routine bugfix release. This is the same setting PHP already listed as a mitigation in the October 21 advisory for CVE-2026-109619. Anyone who applied it then and left it in place needs to do nothing more for the new issue. Session upload progress is turned on by default and lets an application track the progress of a file upload.
Because the setup is uncommon, PHP is handling the fix as part of its regular release cycle rather than as an emergency, and it will publish a full advisory for CVE-2026-115560 with the next release. It is worth noting that PHP has not stated which versions are affected, which releases will contain the fix, or a severity score. It also has not said whether the new issue shares a root cause with CVE-2026-109619.
No exploitation of CVE-2026-115560 has been reported, and the attacks reported since October 21 target the two earlier PHP2Shell flaws. Attempts to exploit the two earlier PHP2Shell flaws have surged, however, with Amazon saying its honeypots logged an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days before the flaws were disclosed. Cloudflare reported that attempts rose from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22.
Attackers have tried to use the flaws to install a Mirai botnet variant, according to Sophos and Arctic Wolf. However, those attempts have so far failed, with Previdian, Wordfence, and others reporting scanning and probing but no confirmed code execution. Researchers say a reliable exploit is proving harder to build than expected. That activity targets the two flaws patched on October 21, not CVE-2026-115560, which has not been reported under attack.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-RCE-Threat-Looms-Over-PHP-Ecosystem-Despite-Recent-Emergency-Patches-ehn.shtml
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
Published: Fri Oct 23 07:30:27 2026 by llama3.2 3B Q4_K_M
