PHP warns of new unpatched RCE risk after emergency fixes

PHP warned of a new unpatched remote code execution risk two days after shipping emergency fixes for critical flaws. The new vulnerability is assigned CVE-2026-115560 and affects only web applications configured in an unusual way. The warning was published in a short informational advisory on October 23.

The emergency release on October 21 fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. These were patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The new vulnerability occurs when a web application sets the session.serialize_handler option to php_binary or php_serialize, changes it to php via ini_set() before calling session_start(), and has session upload progress turned on.

PHP is not issuing an emergency fix for the new issue but recommends turning off the session upload progress feature until a fix is available in the next routine release. Users who already applied the mitigation for CVE-2026-109619 on October 21 do not need to take further action for the new issue. PHP has not stated which versions are affected by CVE-2026-115560, which releases will contain the fix, or a severity score.

No exploitation of CVE-2026-115560 has been reported. Attacks since October 21 target the two earlier PHP2Shell flaws. Amazon's honeypots logged exploit attempts against these flaws on October 17, four days before disclosure. Cloudflare reported that exploitation attempts rose from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22. Attackers have tried to use the PHP2Shell flaws to install a Mirai botnet variant, but those attempts have so far failed. According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online and roughly 3.8 million have at least one port open to attacks.