PHP Shares Workaround for Unpatched RCE Vulnerability Affecting Unusual Configurations
Summary
PHP disclosed CVE-2026-115560, an RCE flaw requiring an unusual session-handler configuration. No patch is available; the PHP team recommends disabling session upload progress until a fix is released.
Key points
- CVE-2026-115560 is exploitable only when an application changes its session serialization handler at runtime before starting a session, with session upload progress still enabled.
- The PHP team recommends setting session.upload_progress.enabled=0 until a security patch is available.
- The PHP team said it will publish a full advisory with a future release and described the vulnerable configuration as unlikely in practice.
- Separately, researchers reported attempts to exploit PHP2Shell flaws before patches were released; reports described scanning and non-working exploits, with no known compromises.
Article Details
- Vulnerability Types
- Remote code execution (RCE)
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Set session.upload_progress.enabled=0.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAttackers attempted to exploit the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619; the article says it is unclear whether any attempts succeeded.T1595 · Active ScanningThe article reports scanning and fingerprinting activity related to PHP2Shell after vulnerability disclosure.
CVE
CVE-2026-109618This mitigation should have already been applied on Wednesday, before patching two other critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.CVE-2026-109619This mitigation should have already been applied on Wednesday, before patching two other critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.CVE-2026-115560According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems "with an unusual combination of configuration and application code."