Just two days after deploying critical emergency patches to address a pair of severe vulnerabilities collectively known as PHP2Shell, the PHP development team has issued an advisory warning of yet another potential mechanism through which malicious actors could execute arbitrary code on vulnerable web servers.
The newly identified issue, officially cataloged under the tracking identifier CVE-2026-115560, has been classified by project maintainers as presenting an unlikely risk. Unlike the previous widespread vulnerabilities, this newly disclosed flaw specifically impacts web applications that are configured in a highly unusual and specific manner. Because of these narrow preconditions, project maintainers have opted against issuing an out-of-cycle emergency patch. Instead, they are advising administrators to implement a straightforward configuration adjustment as a precautionary measure while a permanent fix is prepared for the next routine software update.
This advisory, published as a short informational notice on October 23, arrives on the heels of an urgent security release rolled out on October 21. That emergency patch cycle targeted two critical vulnerabilities—tracked as CVE-2026-109618 and CVE-2026-109619—which granted unauthenticated remote attackers the capability to run arbitrary code directly on targeted servers. Those initial flaws were promptly remediated across multiple active branches in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Project maintainers have clarified that CVE-2026-115560 is an entirely separate security concern and is not resolved by the patches distributed during the October 21 emergency release.
According to technical details provided by the PHP project, exploitation of the newly warned vulnerability requires a very narrow and unconventional set of circumstances. A web application must meet several strict conditions simultaneously for the risk vector to materialize. Specifically, the application must explicitly configure the session.serialize_handler option to either php_binary or php_serialize within its setup files. Furthermore, the application must dynamically alter that option to simply php during runtime by executing an ini_set() function call, and this runtime modification must occur prior to invoking the session_start() function.
In addition to these configuration parameters, the feature known as session upload progress must remain active. If an application utilizes its default configuration and never alters its session serialization handler during runtime, it leaves the upload progress feature enabled without being exposed to this particular attack vector. Because this exact chain of configuration choices and runtime adjustments is rarely encountered in production environments, PHP maintainers maintain that the real-world risk remains exceptionally low.
To mitigate CVE-2026-115560 prior to the rollout of official patches, developers and system administrators are advised to perform a single-line configuration change. PHP recommends disabling the session upload progress feature by setting session.upload_progress.enabled to zero in the server configuration. Notably, this exact mitigation strategy was previously recommended by project maintainers in the October 21 security advisory associated with CVE-2026-109619. Consequently, web administrators who applied that recommended mitigation following the earlier disclosure and left the setting intact are already fully protected against this newly identified secondary vector, requiring no additional action on their part.
Because session upload progress is enabled by default in standard installations to help web applications track the real-time status of file uploads, administrators who have not yet altered their configurations are encouraged to apply the recommended setting as a matter of best practice. Given that the vulnerable setup parameters are uncommon in standard web development paradigms, the PHP team is treating the resolution of CVE-2026-115560 as part of its standard, scheduled bugfix release cycle rather than rushing an emergency deployment. A comprehensive security advisory detailing the vulnerability will be published alongside the next routine software update.
At the time of the announcement, PHP officials had not yet disclosed a complete list of affected software versions, the specific future releases slated to contain the permanent fix, or an official Common Vulnerability Scoring System severity metric. Furthermore, maintainers have not publicly confirmed whether CVE-2026-115560 shares a common underlying root cause with the previously patched CVE-2026-109619 vulnerability. Security researchers note that no active exploitation attempts or field attacks leveraging CVE-2026-115560 have been documented or reported since the advisory was published, with malicious activity remaining heavily focused on the earlier PHP2Shell flaws.
Meanwhile, threat intelligence data indicates that attempts to exploit the two earlier PHP2Shell vulnerabilities have surged dramatically across the global threat landscape. Telemetry released by major cloud and security infrastructure providers highlights the rapid escalation of malicious scanning and probe attempts. Amazon reported that its network honeypots successfully logged an isolated exploit attempt targeting CVE-2026-109618 and CVE-2026-109619 as early as October 17, four days before the vulnerabilities were officially made public. Following the public disclosure on October 21, Cloudflare observed attack volume skyrocket from tens of thousands of requests within the first 45 minutes to millions of cumulative attempts by early the following morning.
Analysis from cybersecurity firms Sophos and Arctic Wolf indicates that a significant portion of these automated exploit waves has been orchestrated by threat actors attempting to deploy a variant of the notorious Mirai botnet infrastructure onto compromised web servers. Despite the massive scale of the probing activity, these automated attacks have largely failed to achieve their objectives. Security organizations such as Previdian and Wordfence have reported widespread scanning traffic and probing signatures, but zero confirmed instances of successful remote code execution resulting from the broader attack waves. Industry researchers note that crafting a reliable, weaponized exploit for the PHP2Shell flaws has proven considerably more complex than initial threat actor projections anticipated.
This high-intensity malicious activity remains strictly directed toward the two high-severity vulnerabilities patched during the October 21 emergency response, leaving CVE-2026-115560 entirely quiet as developers await the next routine maintenance cycle from the PHP project.
