CVE-2026-115560

CVE Enrichment

CISA KEV: Not listed

Last enrichment sync: 23-Oct-2026 22:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. PHP Warns of New RCE Risk in Unusual Session Configuration
According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems "with an unusual combination of configuration and application code." PHP Shares Workaround for Unpatched RCE Vulnerability Affecting Unusual Configurations
On October 23, 2026, PHP disclosed CVE-2026-115560, a separate vulnerability affecting applications that use a specific and uncommon session configuration. PHP2Shell Exposure Extends to Embedded Products as PHP Discloses Separate Session Flaw
Updated October 23, 2026: PHP disclosed a related follow-on issue, CVE-2026-115560, involving an unlikely remote code execution (RCE) vector under unusual session settings. PHP2Shell Flaws Make PHP Inventory and Patching Urgent

CVE (2)

Malware (1)

People (2)

MITRE ATT&CK (2)

Vendors (13)

Products (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.