PHP’s New Unpatched RCE Risk: What CVE-2026–115560 Means for Developers

Just two days after PHP shipped emergency fixes for the critical PHP2Shell vulnerabilities, the PHP project disclosed another potential remote code execution issue: CVE-2026–115560. Unlike PHP2Shell, it is not being treated as an emergency because it affects an uncommon application configuration and has not been reported as exploited.

The important takeaway is not "another catastrophic PHP bug." It is: if your application uses a specific session-handler pattern, disable session upload progress now.

What happened

On October 21, PHP released emergency patches for two critical unauthenticated RCE flaws, CVE-2026–109618 and CVE-2026–109619, collectively called PHP2Shell. These were fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

On October 23, PHP published an informational advisory for a separate issue, CVE-2026–115560. This vulnerability is not fixed by the October 21 emergency updates; PHP plans to address it in a routine release.

Why the risk is limited

CVE-2026–115560 only becomes relevant when an application combines several unusual session settings:

• session.serialize_handler is initially set to php_binary or php_serialize
• The application later changes it to php using ini_set()
• That change happens before session_start() is called
• session.upload_progress remains enabled

If your application never switches the serialize handler at runtime, PHP considers it unaffected through this path. PHP itself describes the configuration as unlikely in real-world applications.

The one-line mitigation

Until the official fix arrives, PHP recommends disabling session upload progress:

session.upload_progress.enabled=0

session.upload_progress.enabled=0

After changing this setting, restart PHP-FPM, Apache workers, or any other long-running PHP processes so the configuration takes effect.

If you already applied this mitigation for CVE-2026–109619, you do not need to take additional action for CVE-2026–115560.

Don't confuse it with PHP2Shell

The distinction matters: PHP2Shell was a runtime-level problem that could affect PHP applications broadly, while CVE-2026–115560 depends on a specific and uncommon application-level configuration.

What backend developers should do

1. Check your PHP version. For PHP2Shell, update to at least PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your branch.
2. Search for runtime handler changes. Look for ini_set('session.serialize_handler', …) and determine whether it runs before session_start().
3. Disable upload progress if not required. Add session.upload_progress.enabled=0 to your PHP configuration unless your application genuinely relies on upload-progress tracking.
4. Restart workers. Configuration changes do not protect existing PHP-FPM or Apache worker processes until they restart.
5. Remember the runtime is separate from your framework. Updating Laravel, WordPress, Symfony, or your application code does not update the underlying PHP runtime; that comes from the server package, container image, or hosting platform.

Security lesson

This incident is a useful reminder that security exposure often lives in configuration interactions, not only in obvious code defects. A feature such as session upload progress may be harmless by itself, but combined with a runtime change to the serialization handler, it can create an exploitation path.

For production systems, the safest posture is simple: keep the PHP runtime patched, minimize exotic session configuration, disable features you do not use, and treat configuration changes as part of your security review not just application logic.