A new PHP remote code execution vulnerability, tracked as CVE-2026-115560, has been disclosed just two days after emergency patches addressed the PHP2Shell flaws.
This issue affects a narrow set of application configurations, and the PHP project considers it an unlikely attack vector. No emergency patch is planned as of now. Administrators are advised to disable PHP’s session upload progress feature until a fix becomes available in a routine release.
What Is CVE-2026-115560?
CVE-2026-115560 involves an unusual interaction between PHP session serialization and the session upload progress feature. Under specific conditions, this behavior could lead to remote code execution on an affected server. An attacker who successfully exploits the flaw may be able to execute malicious code within the privileges of the vulnerable PHP process.
The vulnerability does not affect every PHP application. Exploitation requires a particular combination of session configuration and application behavior, which makes the affected setup less common.
Which PHP Configurations Are at Risk?
The issue requires the application to meet all of these conditions:
- The application configures session.serialize_handler as php_binary or php_serialize.
- It changes that setting to php at runtime using ini_set() before calling session_start().
- Session upload progress remains enabled.
PHP enables session upload progress by default. However, that default alone does not make every PHP server vulnerable. Applications that do not change the serialization handler at runtime are not exposed through this specific attack path.
How to Mitigate CVE-2026-115560
PHP recommends setting session.upload_progress.enabled=0 until the next regular bugfix release. Administrators who already applied this setting as a mitigation for CVE-2026-109619 should keep it in place. No additional action is required for this issue if the setting is already applied.
Conclusion
CVE-2026-115560 highlights the need to review PHP configurations alongside regular security updates. Bobcares helps businesses assess server vulnerabilities, prioritize security risks, and plan remediation. Explore our AI-powered security assessment service to identify weaknesses across your infrastructure.
