PHP RCE risk remains open pending routine security fix
A newly disclosed PHP RCE risk, meaning a weakness that could let an attacker remotely run code on a web server, remains unpatched while the PHP project prepares a fix for its next routine release. The issue is tracked as CVE-2026-115560, a public identifier used to catalogue security flaws. PHP disclosed it in an informational advisory on October 23 and described the practical risk as unlikely because exploitation requires an unusual application configuration.
The vulnerable path exists only when several conditions occur together. A web application must initially configure session.serialize_handler, the setting that controls how session data is stored, as either php_binary or php_serialize. While running, the application must then call ini_set(), a PHP function for changing a configuration option, to switch the handler to php. That change must happen before session_start(), the function that begins or resumes a visitor's session.
Session upload progress must also be enabled. This feature, which is on by default, allows an application to monitor the progress of a file upload. PHP says applications that do not change their serialization handler while running are not exposed through this route and can leave upload progress enabled. The project considers the complete combination of required settings unlikely to appear in practice.
Until the permanent correction is released, PHP recommends placing session.upload_progress.enabled=0 in the relevant configuration. That setting turns off session upload progress. PHP had already recommended the same mitigation on October 21 for CVE-2026-109619, so administrators who applied it then and have kept it in place do not need to make another change for CVE-2026-115560.
The new PHP RCE risk is separate from the two critical PHP2Shell vulnerabilities fixed in the October 21 emergency update. Those earlier flaws, CVE-2026-109618 and CVE-2026-109619, allowed an attacker without an account to execute code on a server. They were corrected in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Installing those releases does not fix CVE-2026-115560.
PHP has not identified which versions are affected by the new issue, which exact releases will include its fix, or what severity score it will receive. The project also has not said whether CVE-2026-115560 and CVE-2026-109619 have the same underlying cause. A fuller advisory is expected alongside the next routine bugfix release rather than through another emergency update.
No exploitation of CVE-2026-115560 has been reported. The attack traffic observed since October 21 is directed at the two earlier PHP2Shell flaws. Amazon said its honeypots, deliberately exposed systems used to record hostile activity, received an exploit attempt involving CVE-2026-109618 and CVE-2026-109619 on October 17, four days before public disclosure. Cloudflare reported that attempts increased from tens of thousands during the first 45 minutes after the October 21 disclosure to millions by early October 22.
According to Sophos and Arctic Wolf, attackers have attempted to use the older flaws to install a Mirai botnet variant, malware intended to add infected systems to a remotely controlled network. Those attempts have so far failed. Previdian, Wordfence and other observers have reported scanning and probing, meaning automated checks for vulnerable targets, but no confirmed code execution. Researchers also report that constructing a reliable exploit has been more difficult than expected. That activity does not represent attacks against CVE-2026-115560.
Website owners should separate the two required responses. The October 21 fixed versions address CVE-2026-109618 and CVE-2026-109619, while disabling session upload progress is the current mitigation for the newly disclosed issue. Administrators who do not manage PHP directly should ask their hosting provider or application developer whether the site uses the narrow runtime configuration described by PHP and whether the temporary setting has been applied.
For WordPress site owners who want a managed service, AEU Hosting provides managed WordPress hosting, secured end to end. Regardless of hosting model, site operators should keep the mitigation active until PHP publishes and they install the routine release containing the permanent fix.