PHP flags a second unpatched code-execution risk days after emergency patches

PHP warned of another potential remote code execution issue, CVE-2026-115560, just two days after it shipped emergency fixes for the critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server. Those were patched on October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The new issue only affects web applications set up in a specific, unusual way: the app must set session.serialize_handler to php_binary or php_serialize in configuration, then change it to php at runtime using ini_set() before calling session_start(), with session upload progress still enabled. PHP calls this setup unlikely in practice and isn't issuing an emergency fix. Instead it recommends disabling session upload progress (session.upload_progress.enabled=0) until a fix ships in the next routine release. Anyone who already applied that same mitigation for the earlier PHP2Shell flaw needs no further action.

Separately, exploitation attempts against the two earlier PHP2Shell flaws have surged, with Cloudflare reporting attempts rising from tens of thousands within 45 minutes of disclosure to millions by the next day. Attackers have tried to use them to install a Mirai botnet variant, but researchers say no confirmed code execution has succeeded yet, and a reliable exploit is proving harder to build than expected. No exploitation of the new CVE-2026-115560 has been reported.

Why it matters

PHP site operators who just patched the critical PHP2Shell bugs now have a second, narrower setting to check before attackers catch up.

Source: The Hacker News