CriticalCVECVE-2026-115560
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
The Hacker News·Source published ·1 min read
What happened?
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called
Key details
- The flaw only affects applications with an unusual configuration involving session serialize handler changes.
- The vulnerable setup requires setting session.serialize_handler to php_binary or php_serialize, then changing it to php via ini_set before session_start.
- Session upload progress must be enabled for the flaw to be exploitable.
- PHP recommends disabling session.upload_progress.enabled until the next routine bugfix release.
- No exploitation of CVE-2026-115560 has been reported; attacks target the earlier PHP2Shell flaws.
Affected
- Web applications using session.serialize_handler set to php_binary or php_serialize, changed to php via ini_set before session_start, with session upload progress enabled.
What to look for
- Exploit attempts against CVE-2026-109618 and CVE-2026-109619 logged by Amazon honeypots on October 17.
- Cloudflare observed exploit attempts rise from tens of thousands to millions within days of disclosure.
- Attackers attempted to install a Mirai botnet variant using the PHP2Shell flaws.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.