‹ FeedCybersecurity
Cybersecurity

CVE-2026-115560: The Third PHP Remote Code Execution Flaw, Explained

PHP disclosed a third remote code execution path on 23 October, and the October 21 releases don't fix it. Here is who is exposed, why there is no emergency patch, and the one setting to change today.

5 min read

**PHP disclosed a third remote code execution path, CVE-2026-115560, on 23 October 2026, and had announced no upstream fix as of 3 November 2026.⁠1 It matters only if your code switches session.serialize_handler to php at runtime while session upload progress is on. Set session.upload_progress.enabled=0 today.**

You're affected if: your application sets session.serialize_handler to php_binary or php_serialize in configuration, switches it to php with ini_set() before session_start(), and session upload progress is enabled. You're not if: any one of those three is false. Turn upload progress off anyway; the cost is low. Status as of 3 November 2026: no upstream fix announced, mitigation available.

The October 21 releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) do not fix it.⁠2 Those releases closed the two flaws nicknamed PHP2Shell, which the complete PHP2Shell guide covers in full. This article covers only the third.

CVE-2026-115560 is separate from PHP2Shell

PHP2Shell is CVE-2026-109618, an out-of-memory corruption bug, and CVE-2026-109619, a stale request-state bug. PHP fixed both on 21 October, and both carry a CVSS v4.0 score of 9.2.⁠1 The new CVE has a different trigger: a configuration and code pattern. PHP's notice describes no memory fault.

The confusion comes from the mitigation. PHP had already listed session.upload_progress.enabled=0 as a workaround for CVE-2026-109619.⁠1 PHP says that if you applied it then, you are done. PHP has not said whether the new flaw shares a root cause with CVE-2026-109619.⁠3

Same setting, different bug.

Why PHP is not shipping an emergency release

Reported PHP calls the setup unlikely in practice. It says exploitation needs "an unusual combination of configuration and application code," so the fix goes into the regular release cycle, and the full advisory arrives with it.⁠1

Compare that with PHP2Shell. CISA added both PHP2Shell flaws to its Known Exploited Vulnerabilities catalog on 26 October.⁠4 On 24 October a Perplexity researcher recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php, consistent with CVE-2026-109618.⁠5 I found no comparable public record for CVE-2026-115560.

PHP 8.1 and older are outside upstream security support. PHP offered source backports for 7.4, 8.0 and 8.1 only for the two PHP2Shell flaws, and said some distributions and LTS vendors provide backported fixes.⁠1 Operators should apply the configuration mitigation immediately and investigate supported upgrades or vendor-maintained security backports. Workarounds for older PHP versions lists what else you can do.

What actually fails

PHP names three conditions, all of which must hold. Configuration sets the serialize handler to php_binary or php_serialize. Application code then switches it to php at runtime with ini_set(), before session_start(). Upload progress is on.⁠1

Applications that never change the handler at runtime can keep upload progress enabled, per PHP.⁠1 PHP has not published the mechanism. That waits for the full advisory.

Condition three is usually true by default. Server Side Up's release notes describe upload progress as enabled by PHP's default.⁠2 Laravel does not use PHP's built-in sessions. You would be exposed only if your own code or a package starts a native PHP session alongside it.⁠6

How you'd notice

PHP has not published a reliable log-based detection method for this vulnerability. Review configuration and application code to determine exposure. Trend Micro adds that network-level detection is difficult until the full advisory exists.⁠7

  • Search your code, including vendor/ and plugins, for ini_set calls that touch session.serialize_handler.
  • Read php.ini, the FPM pool config and any Apache php_value lines for session.serialize_handler and session.upload_progress.enabled.
  • Check the web-serving PHP, not the command line. The CLI can load a different config.
  • Restart every worker after a change. PHP's own 21 October guidance says to set this in php.ini, an FPM pool or server config that applies before request parsing, and not to rely on ini_set() or .user.ini.⁠1

What PHP has and hasn't said

CVEWhat PHP says it isFixed inExploitation (3 Nov)
CVE-2026-109618Out-of-memory corruption8.5.12, 8.4.27, 8.3.36, 8.2.35In CISA's KEV catalog since 26 Oct; extent of exploitation not established
CVE-2026-109619Stale request state8.5.12, 8.4.27, 8.3.36, 8.2.35In CISA's KEV catalog since 26 Oct; extent of exploitation not established
CVE-2026-115560Session upload progress, serializer switchNo upstream fix announced; planned for the next regular releaseNo publicly confirmed exploitation identified as of 3 November 2026

PHP has not stated which versions are affected, which release will carry the fix, or a severity score.⁠3 The PHP news archive had no newer release or advisory than 26 October when I checked on 3 November.⁠1 CISA's 26 October KEV bulletin lists only the two PHP2Shell flaws.⁠4

Opinion Until PHP publishes a complete affected-version list, audit each PHP deployment for the specific configuration and runtime conditions described in its advisory.

Disable upload progress, then audit the code

Do today

  1. Set session.upload_progress.enabled=0 in php.ini or the FPM pool config, restart every PHP worker, and follow the step-by-step guide for per-server syntax.
  2. Confirm the value on the web-serving PHP, not only the CLI.
  3. Keep the setting in place if you already applied it for PHP2Shell.

Do this week

  1. Search your code and dependencies for runtime ini_set() calls on session.serialize_handler.
  2. Update to the fixed release for your supported PHP branch (8.5.12, 8.4.27, 8.3.36 or 8.2.35, respectively) or a later release containing the security fixes. These updates address the two earlier PHP2Shell vulnerabilities, not CVE-2026-115560.
  3. Check container images and hosting defaults for an upload progress setting you did not choose.

Can wait

  1. Plan the upgrade to the release that ships the CVE-2026-115560 fix, and re-read PHP's advisory when it lands.
  2. Remove the mitigation only after you have verified the fix on your version.
  3. Move off PHP 8.2 before its end of life on 31 December 2026.⁠1

FAQ

No. PHP's 23 October advisory says the fix and full advisory come with the next regular release. The 21 October updates fixed CVE-2026-109618 and CVE-2026-109619 only.

The Hacker News reported on 23 October that no exploitation had been reported. CISA's 26 October KEV additions covered only the two PHP2Shell flaws. I identified no publicly confirmed exploitation as of 3 November 2026, though that is not a comprehensive search.

Server Side Up says you lose upload progress tracking through the session. Most progress bars today are driven by browser JavaScript and do not use this feature.

Server Side Up notes that Laravel does not use PHP's built-in sessions. You would be exposed only if your own code or a package starts a native PHP session alongside it.

PHP says the next regular release, with no date. The Hacker News noted on 23 October that PHP had not said which release would carry it.

You've reached the end

CVE-2026-115560: The Third PHP Remote Code Execution Flaw, Explained

Back to the feedRead the full article

The full article has comments, related reading and sharing.