PHP Warns of Second Unpatched RCE After PHP2Shell
PHP warned of a second unpatched remote code execution flaw, CVE-2026-115560, days after the PHP2Shell patches. Here is who is at risk and the one-line fix.
PHP has warned of another way an attacker could run code on a web server, just two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, is not fixed by those emergency releases, and PHP says it will be fixed in the next routine release instead. The good news is that the flaw only affects a narrow, unusual setup, and the fix for now is a single configuration change. If you already disabled session upload progress after the PHP2Shell advisory, you do not need to do anything more.
Another Flaw, Days After the Emergency Patches
PHP published a short informational advisory on October 23 about the new issue. It follows the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server. Those flaws were patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The new issue is separate. PHP says it is not fixed by those releases, and because the setup it needs is unlikely in practice, the project is not issuing another emergency fix. A full advisory will come with the next release.
Who Is Actually at Risk
Only a narrow combination of settings opens this path. All of these must be true at the same time: - The configuration sets session.serialize_handler to php_binary or php_serialize. - The application switches that option back to php while running, using ini_set(), before it calls session_start(). - Session upload progress is still turned on. An application that never changes the serialize handler while running is not exposed through this path, and can leave session upload progress on. PHP calls the setup unlikely in practice, and no exploitation of this new path has been reported so far.
The One-Line Fix
PHP recommends turning off session upload progress until the next routine bugfix release. The setting is: session.upload_progress.enabled=0 Set it in php.ini, an FPM pool or the server configuration, then restart every worker so the change takes effect. Do not rely on ini_set() or a .user.ini file, because they apply too late. Anyone who applied this setting after the October 21 advisory and left it in place needs to do nothing more for the new issue. Session upload progress is turned on by default and lets an application track the progress of a file upload. Turning it off only stops upload progress bars from working. The uploads themselves keep working. The October 21 updates are still required either way. The new setting does not replace them, and PHP 8.2 branch security support ends on December 31, 2026, so sites still on 8.2 should plan their upgrade.
Why It Still Matters
Unauthenticated remote code execution in PHP remains high impact because the language powers a large share of the web. Attackers have already shown intense interest in the PHP2Shell class of flaws, with millions of probes and attempts to drop Mirai malware variants shortly after the first disclosure, even though researchers report no confirmed successful code execution in the wild so far. The lesson from this week is simple. Secure application code does not automatically mean a secure application. Runtime settings, server configuration and how quickly updates are applied matter just as much.
Sources
- The Hacker News - https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html - Cybernews - https://cybernews.com/security/php2shell-attacks-php-new-vulnerabilities-found/