PHP has issued a caution regarding a potential new method for executing code on web servers, shortly after releasing emergency updates for critical PHP2Shell vulnerabilities. This latest issue, identified as CVE-2026-115560, impacts only specific web application configurations. Although deemed unlikely to pose a significant threat, PHP advises disabling the session upload progress feature until a long-term solution is integrated into a future routine update.
Details of the Latest Vulnerability
The advisory concerning CVE-2026-115560 was made public on October 23, following the urgent fixes for PHP2Shell vulnerabilities disclosed on October 21. These earlier vulnerabilities, noted as CVE-2026-109618 and CVE-2026-109619, allowed unauthorized code execution on servers and were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The new vulnerability is separate and remains unresolved in these releases.
Configuration Risks and Mitigation
This vulnerability only affects web applications with a specific configuration. The issue arises when an application initially sets the session.serialize_handler to php_binary or php_serialize, subsequently alters it to php via ini_set(), and then calls session_start() with session upload progress still active. PHP considers this configuration rare, suggesting that applications which do not modify the serialize handler during execution can safely retain the feature.
To mitigate potential risks, PHP recommends adjusting the session.upload_progress.enabled setting to 0 until a bugfix is released. This action aligns with the recommendations previously issued for CVE-2026-109619 on October 21. Applications that have already implemented this precaution do not need further adjustments for the current vulnerability.
Implications and Continued Monitoring
Despite the unusual configuration required to exploit CVE-2026-115560, PHP will address it in its standard release cycle and provide a detailed advisory in an upcoming update. The affected versions and the severity score for this vulnerability remain unspecified. Additionally, PHP has not clarified whether this issue shares any commonality with the earlier PHP2Shell vulnerabilities.
No known exploits for CVE-2026-115560 have been reported. However, there has been a significant increase in attempts to exploit the previous PHP2Shell vulnerabilities since their disclosure. Reports from Amazon and Cloudflare indicate a rise in exploit attempts, with attackers aiming to deploy a Mirai botnet variant. Despite these efforts, successful exploitation has not been confirmed, as security researchers find developing a reliable exploit more challenging than anticipated.
