Just two days after deploying emergency fixes for the critical "PHP2Shell" vulnerabilities, the PHP development team has issued a warning regarding another potential mechanism that attackers could leverage to execute arbitrary code on web servers.
The newly highlighted issue, formally designated as CVE-2026-115560, specifically impacts web applications that are configured under very specific and unusual circumstances. Due to the narrow scope of configurations susceptible to this vector, PHP developers have classified the risk as unlikely in standard production environments. Consequently, the project is bypassing an emergency patch rollout, choosing instead to address the matter through its routine bugfix release cycle.
In the interim, rather than pushing out an immediate software update, the PHP project recommends that administrators disable a built-in feature known as session upload progress. This precautionary measure is intended to neutralize any potential exposure until a permanent fix is integrated into the next scheduled version release.
The warning was formally communicated through a concise informational advisory published on October 23. This notification comes closely on the heels of an emergency release launched on October 21, which addressed two severe vulnerabilities collectively referred to as the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Those critical flaws allowed unauthenticated remote attackers to execute code directly on target servers and were rapidly patched across multiple active branches, specifically in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The newly disclosed security concern is entirely separate from those earlier vulnerabilities and is not resolved by the emergency patches issued on October 21.
According to the details provided by PHP, only a tightly constrained server and application setup runs the risk of exposure to CVE-2026-115560. For an application to be vulnerable, it must satisfy a precise sequence of configuration and execution criteria. Specifically, the web application must explicitly set the session.serialize_handler option to either php_binary or php_serialize within its configuration files. While executing, the application must then programmatically modify that option to php by invoking the ini_set() function. Crucially, this dynamic alteration must occur prior to the application calling session_start().
Furthermore, the session upload progress feature must remain active. Applications that maintain a static serialization handler throughout their execution lifecycle—meaning they never alter the handler dynamically while running—can safely leave the upload progress feature enabled without being exposed to this particular attack vector. Given the complexity and atypical nature of this configuration sequence, PHP maintains that such setups are rarely encountered in real-world deployments.
Because of the uncommon prerequisites required to exploit CVE-2026-115560, PHP has opted to handle the resolution as part of its regular release schedule rather than rushing an emergency patch. A comprehensive advisory detailing the vulnerability will be published alongside the next routine software release. At this stage, PHP has not yet disclosed which specific software branches are affected, which upcoming versions will contain the final fix, or what CVSS severity score will be assigned to the flaw. Furthermore, developers have not clarified whether this new issue shares a fundamental root cause with the earlier CVE-2026-109619 vulnerability.
To mitigate CVE-2026-115560, administrators are advised to adjust a single configuration parameter by setting session.upload_progress.enabled to zero until the next scheduled bugfix release becomes available. Notably, this exact mitigation strategy was already outlined by PHP in the advisory for CVE-2026-109619 released on October 21. System administrators and web hosts who applied that recommendation following the earlier emergency disclosures and left the setting in place do not need to take any additional action to protect against this new advisory. The session upload progress feature is enabled by default in standard PHP installations to allow applications to monitor the real-time progress of file uploads from users.
While CVE-2026-115560 has prompted an advisory, no active exploitation of this specific vulnerability has been observed in the wild. All malicious activity reported since the October 21 disclosures remains strictly focused on probing and attempting to exploit the two earlier PHP2Shell flaws.
In contrast to the newly disclosed advisory, attempts to leverage the earlier PHP2Shell vulnerabilities have surged dramatically across the global internet infrastructure. Major cybersecurity firms and cloud providers have documented an intense wave of scanning and exploit activity targeting servers running unpatched software. Telemetry data shared by Amazon revealed that corporate honeypots logged targeted exploit attempts against CVE-2026-109618 and CVE-2026-109619 as early as October 17, four days before the vulnerabilities were officially made public.
The situation escalated rapidly following the formal disclosure on October 21. Cloudflare reported that inbound exploit attempts surged from tens of thousands within the first 45 minutes of the announcement to millions of individual requests by early October 22. Multiple threat intelligence organizations, including Sophos and Arctic Wolf, observed that external attackers quickly attempted to leverage the vulnerabilities to compromise web servers and install variants of the Mirai botnet.
Despite the massive volume of probing traffic, security researchers note that these automated exploitation attempts have largely failed to achieve their objectives. Firms such as Previdian and Wordfence have reported widespread scanning and probing activity, but no confirmed instances of successful remote code execution resulting from these specific campaigns. Cybersecurity analysts explain that engineering a reliable, weaponized exploit for the PHP2Shell flaws has proven significantly more difficult for attackers than initially anticipated.
The heightened attack activity and widespread scanning operations remain firmly directed at the two vulnerabilities patched during the October 21 emergency response, leaving the newly detailed configuration-dependent issue free from reported exploitation attempts.
