Skip to content
Hacker Posts

PHP flags a third session bug (CVE-2026-115560) — but calls RCE unlikely

PHP's Oct 23 advisory flags CVE-2026-115560, a session-upload-progress issue it rates an unlikely RCE vector. No emergency patch — the workaround is the same one shipped for CVE-2026-109619.

Published 2 min read
cvephpadvisory

Two days after its emergency PHP2Shell release, PHP issued a short informational advisory on Oct 23 for a third session-handling issue, CVE-2026-115560. Unlike the two flaws patched on Oct 21, this one ships no emergency fix — PHP is handling it in the regular release cycle and explicitly calls it an "unlikely RCE vector." The Hacker News covered the notice. The useful read for operators is where the hype stops: this needs an unusual configuration, and most installs are not exposed.

What triggers it

Per PHP's advisory, the issue only arises when an application does all three of the following:

  • sets session.serialize_handler to php_binary or php_serialize in configuration,
  • switches it to php at runtime with ini_set() before calling session_start(), and
  • still has session upload progress enabled.

Applications that never change the serialize handler at runtime can leave the feature on. PHP has not yet disclosed affected version numbers or a severity score; a full advisory will accompany the next bugfix release.

What to do today

  1. If you already applied the CVE-2026-109619 mitigation, you're done. PHP confirms the same setting covers this issue — no further action.
  2. Otherwise, set the workaround until the next bugfix release:
; php.ini
session.upload_progress.enabled=0
  1. Apply it where it takes effect before request parsing — php.ini, an FPM pool, or server config — not via ini_set() or .user.ini, per PHP's earlier guidance, and restart every worker.
  2. Check whether you even match the pattern. grep your codebase for ini_set('session.serialize_handler' before treating this as urgent.

Context

This is the third PHP session issue in a week, and the three are not equal. CVE-2026-109618 and CVE-2026-109619 — the "PHP2Shell" pair — are unauthenticated RCE and are under active mass exploitation: SecurityWeek reports Mirai operators joining the attacks and ASLR-bypass exploits emerging, with millions of exploit attempts logged. CVE-2026-115560 is the opposite end of the scale: a narrow, config-dependent variant PHP itself downgrades. The risk here is misallocation — teams scrambling to "patch the new PHP CVE" while unpatched PHP2Shell servers are the ones actually being shelled. Fix the exploited pair first; the Oct 23 item is a one-line INI setting you likely already have.

Related stories