PHP offers mitigation for unpatched RCE flaw, as PHP2Shell bugs draw attack attempts
The PHP security team published workaround advice for a new remote code execution flaw that has no patch, and said the earlier PHP2Shell bugs are already being probed in the wild.
The PHP security team has published mitigation advice for a new remote code execution flaw that has no patch, BleepingComputer reported on October 23, 2026.
The bug, tracked as CVE-2026-115560, is described by the PHP team as exploitable only against systems "with an unusual combination of configuration and application code." An application would have to set session.serialize_handler to php_binary or php_serialize, then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled.
Because that setup is unlikely in practice, the team said it is handling the issue in the regular release cycle and will publish a full advisory with the next release. Until then, it suggested setting session.upload_progress.enabled=0, adding that admins who already applied that setting should keep it in place.
Separately, the source reports that the two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, were patched on Wednesday. Several security companies and Amazon Threat Intelligence reported exploitation attempts before the patches shipped, though it is unclear whether any succeeded. Dataminr's TRACE team said observed activity was limited to scanning, fingerprinting and non-working exploits, with no known compromises.
For defenders, the practical step is to check whether any application changes the session serialize handler at runtime, and to apply the upload progress setting where it isn't needed.
CVE references
Sources
- PHP shares mitigation for new RCE vulnerability with no patchPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning