Just two days after releasing emergency security patches for two critical PHP vulnerabilities, the PHP development team has disclosed another remote code execution (RCE) risk, tracked as CVE-2026-115560.PHP reported the issue on October 23, 2026, but hasn't released a fix yet. The bug is tied to a specific, uncommon PHP configuration. On servers with this configuration, attackers may be able to execute malicious code.
PHP developers have published a temporary mitigation and confirmed they will include a permanent fix in an upcoming regular maintenance release.
What Is CVE-2026-115560?
CVE-2026-115560 is a newly disclosed vulnerability involving PHP’s session upload progress functionality.
This functionality allows PHP applications to track file upload progress by temporarily storing upload information in session data.
According to the official PHP announcement, exploitation is only possible when several specific conditions are met:
- The application initially configures session.serialize_handler as php_binary or php_serialize.
- Application code subsequently changes the handler to php using ini_set().
- This change occurs before session_start() is called.
- PHP’s session.upload_progress.enabled setting remains enabled.
The PHP development team considers this combination unlikely in typical applications, so the vulnerability isn't receiving another emergency security release.
However, applications that meet these conditions could be vulnerable to remote code execution.
Are you looking for a trusted partner in the web hosting market? Bacloud is a global provider offering a wide range of services—from small-business hosting to enterprise solutions—across multiple locations worldwide.
Check out Bacloud services
How Serious Is the Vulnerability?
Unlike the earlier PHP2Shell vulnerabilities, CVE-2026-115560 does not currently have an official PHP severity rating or CVSS score.
However, Amazon Linux has assigned the vulnerability a CVSS score of 8.1 (High), indicating potentially serious security consequences.
Amazon’s assessment describes a network-accessible attack vector that requires no authentication or user interaction, though exploitation complexity is considered high.
The PHP project has not yet released a complete technical explanation of the underlying vulnerability.
The full security advisory is expected alongside the official patch.
Which PHP Versions Are Affected?
PHP has not yet confirmed which versions are affected. For now, users running PHP 8.2, 8.3, 8.4, or 8.5 should check their settings and follow the recommended security measures.
Older PHP installations may also need attention, especially if they use unsupported versions that no longer receive regular upstream security updates.
Importantly, the emergency PHP releases published on October 21 do not address CVE-2026-115560.
These releases included:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
They address the separate PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Installing those emergency updates does not eliminate the newly disclosed vulnerability.
How to Protect Your PHP Servers
Until an official patch becomes available, the PHP development team recommends disabling session upload progress.
Administrators can apply the following PHP configuration:
session.upload_progress.enabled = 0
This setting can be configured in the appropriate php.ini file or other supported server-level PHP configuration.
After modifying the configuration, administrators should restart the relevant PHP service or PHP-FPM workers to ensure the change takes effect.
Red Hat has also confirmed that disabling PHP session upload progress protects against CVE-2026-115560.
Additionally, administrators should review applications that modify session.serialize_handler dynamically using ini_set().
Applications that do not require session upload progress should generally keep this functionality disabled.
Disabling this feature may affect applications relying on PHP’s built-in session-based upload tracking, so administrators should verify application compatibility.
Has CVE-2026-115560 Been Exploited?
As of October 26, there are no publicly confirmed reports of successful attacks specifically exploiting CVE-2026-115560.
Some publicly available proof-of-concept claims have appeared, but no one has independently confirmed their effectiveness.
This differs from the earlier PHP2Shell vulnerabilities, for which security researchers have already reported exploitation attempts.
While the new vulnerability appears significantly more difficult to exploit, administrators should not ignore it simply because the required configuration is uncommon.
When Will PHP Release a Fix?
The PHP development team has confirmed it will address CVE-2026-115560 through its regular release cycle.
A complete security advisory explaining the technical details is expected when the patch becomes available.
Until then, administrators should maintain the recommended mitigation and monitor official PHP security announcements.
The latest information is available through the PHP project website and the CVE-2026-115560 record.
Final Recommendations
The disclosure of CVE-2026-115560 follows an unusually busy week for PHP security, with three remote code execution vulnerabilities announced within just a few days.
Although the latest vulnerability requires a rare configuration combination, it could still have serious consequences.
Administrators should disable session upload progress when it isn't required, review their PHP configurations, and keep systems on the latest available security releases.
Once the official patch becomes available, administrators should update affected systems promptly.