cyber.hendryadrian.com
Vulnerability & Exploit · socprime.com

Unpatched PHP RCE Flaw Requires an Uncommon Session Configuration

· Original article ↗

Summary

PHP disclosed an unpatched RCE flaw requiring an uncommon session-serialization configuration. No exploitation was reported as of Oct. 26, 2026; disabling session upload progress is the interim mitigation, and prior PHP2Shell fixes do not address it.

Key points

  • The vulnerability requires session.upload_progress.enabled to remain enabled and an application to switch session.serialize_handler from php_binary or php_serialize to php at runtime before session_start().
  • PHP considers the configuration uncommon and plans to address the flaw in its next regular bugfix release; no permanent patch is available yet.
  • PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix the earlier PHP2Shell vulnerabilities but do not remediate CVE-2026-115560.
  • PHP recommends setting session.upload_progress.enabled=0 and restarting PHP workers and relevant web services.
  • PHP has not disclosed the complete technical root cause or exact vulnerable version ranges. No public PoC or exploitation of this CVE was reported as of Oct. 26, 2026.
  • Defenders should review application code for runtime serializer changes and monitor PHP worker behavior, multipart requests, and unexpected file creation.

Article Details

Vulnerability Types
  • Remote code execution (RCE)
  • Session serialization and upload-progress handling flaw
Severity
Not disclosed
Affected Versions
  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35
Exploitation Status
not_reported
Exploit Availability
none_reported
Patch Status
unavailable
Workarounds
  • Set session.upload_progress.enabled=0 and restart PHP workers and relevant web services.
  • If disabling upload progress is not operationally possible, assess whether the application changes session.serialize_handler at runtime before session_start().
  • AWS PHP application WAF rules can block POST requests combining PHP session identifiers with PHP_SESSION_UPLOAD_PROGRESS; the article describes this as defense in depth.

CVE

CVE-2026-109618The issue was disclosed on October 23, 2026, only two days after PHP released emergency fixes for the critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.CVE-2026-109619The issue was disclosed on October 23, 2026, only two days after PHP released emergency fixes for the critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.CVE-2026-115560PHP has disclosed CVE-2026-115560, a new remote code execution risk affecting web applications that use an unusual combination of PHP session configuration and runtime behavior.

Vendors

Amazon Web ServicesAWS has also noted that its PHP application WAF rules can block POST requests combining PHP session identifiers with the PHP_SESSION_UPLOAD_PROGRESS field, providing another defensive layer for environments that cannotPHPPHP has disclosed CVE-2026-115560, a new remote code execution risk affecting web applications that use an unusual combination of PHP session configuration and runtime behavior.

Products

PHPPHP has disclosed CVE-2026-115560, a new remote code execution risk affecting web applications that use an unusual combination of PHP session configuration and runtime behavior.

Related Articles