New PHP Remote Code Execution Flaw Disclosed With No Patch Available
PHP has disclosed a new remote code execution vulnerability, CVE-2026-115560, advising administrators to disable session upload progress until a fix is released.
CVE-2026-115560 is a new remote code execution weakness disclosed by PHP without a patch yet. Disclosed two days after emergency fixes for the PHP2Shell flaws, PHP considers the risk unlikely and will skip an emergency release. Instead, administrators should disable the session upload progress feature until the next routine bugfix release.
Published October 23, the advisory outlines specific exposure conditions. An application is vulnerable only if session.serialize_handler is configured as php_binary or php_serialize, switched to php at runtime via ini_set(), and that switch happens before session_start() is called. Setting session.upload_progress.enabled=0 serves as a workaround. Applications never changing the session serializer at runtime remain safe.
This issue is entirely separate from the PHP2Shell vulnerabilities addressed in the October 21 releases. Those updates—versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35—patched CVE-2026-109618 and CVE-2026-109619. Both unauthenticated remote code execution bugs carry a CVSS v4.0 rating of 9.2. Researchers from Calif, OpenAI, and Wiz discovered the PHP2Shell bugs, which leaked on October 20 prior to the coordinated release. CVE-2026-109618 stems from out-of-memory corruption, while CVE-2026-109619 involves stale state left by a fatal error.
Admins should apply the October 21 updates immediately and audit codebases for ini_set() calls preceding session_start() if runtime session serialization changes occur.