PHP Warns New RCE Flaw CVE-2026-115560, Recommends 1-Line Mitigation
Updated
Updated · The Hacker News · Oct 23
PHP Warns New RCE Flaw CVE-2026-115560, Recommends 1-Line Mitigation
3 articles · Updated · The Hacker News · Oct 23
Summary
CVE-2026-115560 is a newly disclosed, unpatched remote-code-execution path in PHP that the project says is separate from the PHP2Shell bugs fixed on October 21.
PHP called the risk unlikely because exploitation requires a narrow setup: an app must switch session.serialize_handler from php_binary or php_serialize to php via ini_set() before session_start(), with session upload progress still enabled.
The immediate workaround is one line — set session.upload_progress.enabled=0 — and users who already applied that mitigation for CVE-2026-109619 do not need any further change.
PHP is deferring a fix to its next routine bugfix release rather than issuing an emergency patch, and has not yet named affected versions, assigned a severity score, or reported any exploitation.
Attacks are instead surging against the two earlier PHP2Shell flaws: Cloudflare saw attempts jump from tens of thousands within 45 minutes of disclosure to millions by early October 22, though researchers say reliable code execution remains elusive.