PHP Warns of New RCE Risk in Unusual Session Configuration
Summary
PHP says CVE-2026-115560 may enable code execution in a narrowly configured application. It recommends disabling session upload progress until a routine fix; no exploitation of this issue has been reported.
Key points
- CVE-2026-115560 may allow code execution when an application changes its session serialization handler to php before calling session_start(), while session upload progress remains enabled.
- PHP considers the configuration unlikely and is planning a routine fix, not an emergency release.
- PHP recommends setting session.upload_progress.enabled=0 until the fix is available.
- PHP has not specified affected versions, the releases that will include the fix, or a severity score.
- No exploitation of CVE-2026-115560 has been reported; reported attacks target the separately patched PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619.
- Attempts to exploit the earlier flaws reportedly surged after disclosure, but multiple researchers and security companies reported scanning and probing without confirmed code execution.
Article Details
- Vulnerability Types
- Remote code execution (RCE)
- Severity
- Unknown
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Set session.upload_progress.enabled=0 until the next routine bugfix release.
CVE
CVE-2026-109618on October 23. It follows the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server. Those wereCVE-2026-109619the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server. Those were patched in PHP 8.5.12,CVE-2026-115560The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.