You just breathed a sigh of relief after updating PHP to the emergency patch for two deadly PHP2Shell vulnerabilities. You thought you were safe. But just two days later, a new warning appeared, and this time, it brought an uncomfortable truth: there is still another unpatched vulnerability.
In this article, we will dissect CVE-2026-115560 – the newly disclosed remote code execution (RCE) vulnerability in PHP – from the perspective of someone who has witnessed many seemingly minor bugs turn into disasters. We will answer the question: Is this a real threat, or just a false alarm?
Background: When PHP2Shell is Patched, a New Vulnerability Emerges
To understand the story, let's rewind a few days. On October 21, 2026, the global PHP community experienced one of the most intense days in years.
Two critical vulnerabilities named CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell by researchers, were urgently patched. Both were rated 9.2 out of 10 on the CVSS v4.0 scale – a "critical" severity level – and allowed attackers to execute remote code without authentication. In other words, an attacker could take control of your web server without needing any account.
Patches were released for PHP branches 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Millions of administrators worldwide breathed a sigh of relief, updated their systems, and went back to their routine work.
But then, on October 23, just two days later, PHP released another brief notice. This time, they did not release an emergency patch. They simply warned about another vulnerability: CVE-2026-115560.
What is CVE-2026-115560 and Why Does PHP Consider It "Unlikely"?
The first thing to emphasize: CVE-2026-115560 is not a mass-exploitable vulnerability. This is a fundamental difference from PHP2Shell.
According to the official announcement from PHP, this vulnerability only affects web applications configured in a very specific and uncommon way. For a system to be vulnerable, the application must meet all of the following conditions simultaneously:
- Setting session.serialize_handler to php_binary or php_serialize in the configuration file.
- Changing that value to "php" while the application is running, via the ini_set() function.
- Making this change before calling the session_start() function.
- The session upload progress feature remains enabled.
If your application never changes the serialize handler at runtime, you can leave this feature enabled without running the risk of this attack vector. Because of this rare combination, PHP rates this as an unlikely risk and decided not to release an emergency patch. Instead, they will handle it in the next regular release cycle.
However, do not become complacent. "Unlikely" does not mean "impossible." And in cybersecurity, seemingly harmless vulnerabilities are often the key to the most sophisticated attacks.
The Only Defensive Measure: Disable session.upload_progress.enabled
Since there is no official patch yet, PHP provides a single clear recommendation: set session.upload_progress.enabled=0 until the next patch is released.
This is a simple yet effective configuration change. You can do this by adding the following line to your php.ini file:
session.upload_progress.enabled = Off
Or, if you are using PHP-FPM, you can add it to your pool configuration:
php_admin_flag session.upload_progress.enabled Off
After making changes, remember to restart all PHP worker processes to ensure the new configuration takes effect.
It is worth noting that this recommendation is not new. It was previously suggested as a mitigation for CVE-2026-109619 during the earlier PHP2Shell patching round. If you already applied it and kept it, you do not need to do anything further for this new vulnerability. But if you skipped it, now is the time to review.
Why This Vulnerability is Still Worth Caring About, Even if PHP Says "Unlikely"
You might ask yourself: "If PHP says it's unlikely to happen, why should I bother?"
The answer lies in the nature of the PHP ecosystem. PHP is not just a language. It is the backbone of a large portion of the internet. WordPress, Drupal, Joomla, Magento, Laravel – they all run on PHP. And among countless such systems, quite a few applications are configured in unique, even quirky ways that the original developers may not have anticipated the consequences of.
Furthermore, history has proven that "unlikely" vulnerabilities are often the final piece of the puzzle in a complex attack chain. Attackers can combine a Local File Inclusion (LFI) vulnerability with CVE-2026-115560 to achieve RCE. Or they can exploit another flaw to alter the session configuration before exploiting this vulnerability.
And most importantly: disabling session.upload_progress.enabled does no significant harm. This feature only allows tracking file upload progress, and most applications do not actually need it. So why take the risk?
Things You Need to Do Right Now
If you are managing any PHP servers – whether a personal website, business application, or client system – these are steps you should take starting today.
1. Check Your PHP Version
First, determine which PHP version you are running. You can create a phpinfo.php file containing the line <?php phpinfo(); ?> and access it via browser, or run the php -v command from the terminal. If you are using PHP 8.2, 8.3, 8.4, or 8.5, make sure you have updated to the latest PHP2Shell patches (8.5.12, 8.4.27, 8.3.36, 8.2.35). If you are using PHP 8.1 or lower, you need to upgrade to a supported version or contact your service provider for a backported patch.
2. Disable session.upload_progress.enabled Immediately
Whether you fall into the "unlikely" group or not, disabling this feature is a simple and inexpensive defensive measure. Do it now, do not wait.
3. Review Application Session Configuration
Check if your application uses ini_set('session.serialize_handler', ...) in its source code. If so, review the logic and ensure it does not create the conditions for the vulnerability. This is also an opportunity to review your entire session configuration, ensuring everything operates in the safest way possible.
4. Monitor Future PHP Releases
PHP has stated they will release a patch for CVE-2026-115560 in the next regular release cycle, accompanied by a full advisory. Subscribe to notifications from PHP.net or follow reputable cybersecurity channels to avoid missing out.
When Complacency is the Greatest Enemy
The story of CVE-2026-115560 cannot be separated from the context of PHP2Shell. Within just a few days, the PHP community faced two consecutive waves of alerts. And the scary part is: attacks exploiting PHP2Shell spiked millions of times within just 45 minutes of the patch being published. Attackers attempted to install Mirai botnet variants, and while those efforts have so far been deemed unsuccessful in executing code, scanning and probing continue relentlessly.
This reveals a harsh truth: attackers are always waiting. They wait for you to delay updates. They wait for you to overlook a small configuration. And they will exploit any loophole you leave behind.
With CVE-2026-115560, PHP has issued an early warning. They are not hiding it. They are not waiting until a new patch is published. They state clearly: "This is a vulnerability, it is unlikely, but here is how to protect yourself right now."
Your job is to listen and act.
Have you checked the PHP configuration on your server – and are you certain you do not fall into the "unlikely" yet vulnerable group? If you are a system administrator, how would you prioritize handling CVE-2026-115560 compared to the hundreds of other tasks waiting for you? Share your perspective below, because in this relentless battle, complacency is the biggest vulnerability!
0 Comment
Add your comment to this article