CVE-2026-115560: New Unpatched PHP Flaw After PHP2Shell and How to Mitigate It

Just two days after the emergency PHP2Shell patches, PHP announced another remote code execution risk: CVE-2026-115560. This time there is no patched version yet. The good news is that it only affects an unusual configuration, and one setting blocks it. Here is how to know if you are exposed and what to change today.

What Is CVE-2026-115560?

CVE-2026-115560 is a flaw in PHP’s session upload progress feature, which tracks file uploads inside $_SESSION. In a specific session setup it may let an attacker execute code on the server. PHP published a short informational advisory on October 23 and says a full advisory will follow with the next release. PHP has not yet named affected versions or a severity score.

Who Is Affected by CVE-2026-115560?

You are only exposed if all three of these are true:

1. session.serialize_handler is set to php_binary or php_serialize in your PHP configuration.
2. Your code, or a package, switches it to php with ini_set() before calling session_start().
3. session.upload_progress.enabled is on, which is the default.

Changing the handler in the middle of a request is rare, so PHP considers exposure unlikely. For example, according to Server Side Up, Laravel is not exposed by default because it does not use PHP’s native session handling.

How to Check Your Server

First, search your code and your vendor/ folder for anything that changes the handler:

grep -rn "serialize_handler" --include="*.php" .

Then check the current settings of the PHP that serves your site:

php -i | grep -E "session.serialize_handler|session.upload_progress.enabled"

If the grep finds nothing, you are very unlikely to be affected by CVE-2026-115560. Even so, the mitigation below is quick and safe for almost every site.

How to Mitigate CVE-2026-115560

Add or change this line in php.ini, or in your PHP-FPM pool configuration:

session.upload_progress.enabled = 0

Then restart PHP, for example:

sudo systemctl restart php8.3-fpm   # match your version
sudo systemctl restart apache2      # if you use mod_php

Do not set it with ini_set() or in .user.ini, because the setting must apply before PHP parses the request. The only side effect is that PHP stops tracking upload progress in $_SESSION. Most modern upload progress bars use JavaScript in the browser instead, so users will not notice.

If you already applied this setting for PHP2Shell (CVE-2026-109619), you are covered, so leave it in place. On shared hosting, ask your host whether they have disabled session upload progress, as many did during the PHP2Shell response.

PHP2Shell Attacks Are Still Growing

This new flaw arrives while attacks on PHP2Shell continue. Cloudflare reported attempts going from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22. Sophos and Arctic Wolf saw attempts to install a Mirai botnet variant, although Sophos said there was no evidence of a successful compromise. If you have not patched PHP yet, read our full PHP2Shell patch guide first.

Frequently Asked Questions

Is CVE-2026-115560 the same as PHP2Shell?

No. It is a separate issue, announced on October 23, 2026, two days after the PHP2Shell patches. Those patches do not fix it.

Am I affected by CVE-2026-115560?

Only if your app sets session.serialize_handler to php_binary or php_serialize, switches it to php with ini_set() before session_start(), and session upload progress is enabled. Most apps never change the handler at runtime.

Is WordPress affected?

The vulnerable pattern is unusual and PHP considers exposure unlikely in practice. Still, the recommended setting is harmless for almost every site, so applying it is a cheap precaution.

Is there a patch?

Not yet. PHP will fix it in its next routine release and publish a full advisory then. Until then, the mitigation is session.upload_progress.enabled = 0.

Has it been exploited?

No exploitation of CVE-2026-115560 had been reported as of October 27, 2026.

Get free security alerts

One short email when a critical vulnerability or a broken update needs your attention. No spam, unsubscribe anytime. See our privacy policy.

Please enable JavaScript in your browser to complete this form.

Email

Email *

Get free security alerts

Sources

• The Hacker News: PHP warns of another unpatched RCE risk
• Server Side Up: A new PHP CVE was announced
• Cybernews: Millions of PHP attacks recorded

Keep learning: brush up on the essential Linux commands you need to manage a server.