PHP2Shell Exposure Extends to Embedded Products as PHP Discloses Separate Session Flaw
Summary
PHP disclosed CVE-2026-115560, a separate session-configuration flaw, as reporting on PHP2Shell exploitation attempts and scanning continues. Vendor assessments show PHP2Shell exposure in embedded products; successful exploitation remains deployment-dependent, with no |
Key points
- CVE-2026-115560 affects applications that change session.serialize_handler to php before calling session_start() while session upload progress is enabled. PHP has not assigned a CVSS score or published a complete affected-version range.
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is subject to widespread scanning and reported exploitation attempts, but successful exploitation depends on deployment conditions; evidence of large-scale successful exploitation remains limited.
- Researchers say some publicly shared proof-of-concept exploits use older session-poisoning techniques against local file inclusion flaws rather than exploiting PHP2Shell.
- Exposure includes products embedding PHP, not only standalone PHP servers. As of October 23, the NCSC-NL inventory listed 224 vulnerable products, 110 fixed, 394 under investigation, and 30 unaffected.
- The article recommends updating PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address PHP2Shell, and following vendor guidance for products that bundle PHP.
- Disabling session.upload_progress.enabled is an interim mitigation for CVE-2026-109619 and CVE-2026-115560; PHP says it does not replace security updates.
Article Details
- Vulnerability Types
- PHP runtime vulnerabilities
- Session-handling vulnerability
- Severity
- PHP2Shell is described as a critical risk; CVE-2026-115560 has no assigned CVSS score.
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- partial
- Workarounds
- Disable session.upload_progress.enabled and restart PHP workers where runtime configuration is under direct control.
- For CVE-2026-115560, review applications for runtime changes to session.serialize_handler before session_start() while session upload progress is enabled.
MITRE ATT&CK
CVE
CVE-2026-109618Reports of exploitation attempts and large-scale scanning targeting PHP2Shell (CVE-2026-109618 and CVE-2026-109619) continue to increase, but researchers report that reliable exploitation appears dependent on specificCVE-2026-109619Reports of exploitation attempts and large-scale scanning targeting PHP2Shell (CVE-2026-109618 and CVE-2026-109619) continue to increase, but researchers report that reliable exploitation appears dependent on specificCVE-2026-115560On October 23, 2026, PHP disclosed CVE-2026-115560, a separate vulnerability affecting applications that use a specific and uncommon session configuration.
Vendors
BroadcomSeveral vendors have already released fixes or mitigation guidance, including Broadcom for Symantec Endpoint Protection Manager, Synology for supported PHP packages, and Google for PHP-based cloud workloads that requireCiscoConfirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.CitrixConfirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.F5Confirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.Googleincluding Broadcom for Symantec Endpoint Protection Manager, Synology for supported PHP packages, and Google for PHP-based cloud workloads that require rebuilding and redeployment.Hewlett Packard EnterpriseConfirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.NetAppConfirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.Palo Alto NetworksConfirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.QNAPConfirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.Synologyreleased fixes or mitigation guidance, including Broadcom for Symantec Endpoint Protection Manager, Synology for supported PHP packages, and Google for PHP-based cloud workloads that require rebuilding andTrend MicroConfirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.
Products
DrupalThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.JoomlaThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.MagentoThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.MoodleThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.NextcloudThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.PHPVendor investigations have shown that exposure extends beyond standalone PHP web servers to products that embed PHP, including appliances, management platforms, security products, and cloud services.phpMyAdminThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.Symantec Endpoint Protection ManagerSeveral vendors have already released fixes or mitigation guidance, including Broadcom for Symantec Endpoint Protection Manager, Synology for supported PHP packages, and Google for PHP-based cloud workloads that requireWordPressThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.ZabbixThe inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.