PHP Discloses New RCE Vulnerability: Check These Security Settings

The PHP Security Team has disclosed another remote code execution (RCE) vulnerability, raising fresh concerns for website administrators and developers. Tracked as CVE-2026-115560, the flaw affects PHP session upload progress functionality but requires an unusual combination of configuration settings and application code to exploit.

Unlike the recently disclosed PHP2Shell vulnerabilities, the new issue is not scheduled for an emergency security release. PHP plans to address it in a regular bug-fix release because the specific configuration required for exploitation is considered uncommon.

Nevertheless, administrators are being advised to disable session upload progress temporarily as a precaution until the fix becomes available.

What Is CVE-2026-115560?

CVE-2026-115560 involves PHP's session upload progress feature, which helps applications track the progress of file uploads.

According to the PHP Security Team's advisory published on October 23, 2026, exploitation requires a specific sequence of configuration changes. An application must initially configure session.serialize_handler as either php_binary or php_serialize, then switch the setting to php at runtime using ini_set() before calling session_start().

Session upload progress must also remain enabled for the vulnerable configuration to apply.

This combination is unusual, meaning that applications that never change their session serialization handler at runtime are not exposed to this particular attack scenario.

However, administrators should verify their actual application configuration rather than assuming they are safe.

How to Protect PHP Applications

The PHP Security Team recommends disabling session upload progress until the next regular bug-fix release.

Administrators can apply this mitigation by setting the following directive in the appropriate PHP configuration:

session.upload_progress.enabled = 0

The setting should be applied through the relevant server-side PHP configuration, such as php.ini or an applicable PHP-FPM pool configuration. Administrators should then restart the affected PHP workers or services as appropriate and verify that the change has taken effect.

The advisory also notes that this mitigation was previously recommended for CVE-2026-109619, one of the PHP2Shell vulnerabilities. Administrators who already applied the setting should keep it enabled.

The change is a temporary security measure, not a replacement for installing the eventual official fix.

How the New Flaw Relates to PHP2Shell

The latest disclosure follows two critical PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.

Those vulnerabilities raised alarms because they could allow unauthenticated attackers to execute code remotely on affected PHP servers. The potential consequences include server compromise, exposure of sensitive information, and disruption of online services.

The PHP Security Team released emergency updates for PHP2Shell on October 21, 2026. Security agencies subsequently urged organizations to prioritize patching internet-facing systems.

The newer CVE-2026-115560 issue is different. Its unusual configuration requirements are the reason PHP is handling it through the regular release cycle rather than issuing another immediate out-of-band update.

Even so, the latest disclosure reinforces the importance of reviewing PHP configurations and keeping server software current.

Why PHP2Shell Caused So Much Concern

PHP is widely used to build websites, content management systems, and web applications. As a result, vulnerabilities in the PHP runtime can affect a broad range of online services.

The PHP2Shell disclosure attracted particular attention because the flaws could enable remote code execution without authentication. Attackers who successfully exploit such vulnerabilities may be able to run commands with the privileges of the affected PHP worker.

The timing of the disclosure also drew attention. Reports described exploitation attempts emerging around the release of public technical information and security fixes.

Although exploit attempts do not automatically mean that systems have been compromised, they can significantly increase the pressure on administrators to patch vulnerable deployments quickly.

Organizations should therefore treat the earlier PHP2Shell vulnerabilities as a separate, urgent patching priority rather than focusing exclusively on the newer, less commonly exploitable flaw.

Does Address Space Layout Randomization Stop PHP Exploits?

Address Space Layout Randomization (ASLR) is a security mechanism that randomizes the locations of important code and data in memory. This can make certain exploitation techniques more difficult because attackers cannot always reliably predict where particular memory regions will be located.

Security researchers have suggested that ASLR may complicate reliable exploitation of PHP2Shell under some conditions. However, ASLR is a defensive layer, not a substitute for fixing vulnerable software.

Its effectiveness depends on the vulnerability, the operating environment, and the attack technique. Organizations should not assume that ASLR alone prevents remote code execution.

The safest approach remains installing the appropriate security updates and reviewing additional protections such as access controls, monitoring, and web application firewalls where applicable.

What Website Owners and Developers Should Do Next

Administrators can reduce their exposure by following several practical steps:

1. Patch PHP2Shell vulnerabilities immediately. Use the official security updates for the PHP branch running on the server.
2. Disable session upload progress temporarily. Set session.upload_progress.enabled=0 until the fix for CVE-2026-115560 is available.
3. Review session configuration. Check whether application code changes session.serialize_handler at runtime before calling session_start().
4. Restart and verify PHP services. Confirm that configuration changes have taken effect across relevant PHP workers and environments.
5. Monitor for suspicious activity. Investigate unexpected PHP worker behaviour, unauthorized processes, or unusual server activity.
6. Keep tracking official advisories. Install the relevant regular bug-fix release when PHP publishes the fix for CVE-2026-115560.

Website owners using managed hosting should contact their hosting provider if they cannot directly access PHP configuration or update the runtime themselves.

Final Verdict

CVE-2026-115560 is a newly disclosed PHP remote code execution vulnerability with an unusual set of exploitation requirements. Its limited configuration scope explains why the PHP Security Team plans to fix it through the regular release cycle rather than an emergency patch.

Still, unusual does not mean impossible. Administrators should apply the recommended mitigation, verify their server configuration, and keep their PHP installations updated.

Most importantly, the new disclosure should not distract from the separate PHP2Shell vulnerabilities, for which security updates have already been released and urgent patching remains essential.

Official reference: PHP security advisories