PHP has disclosed CVE-2026-115560, an unpatched remote-code-execution path involving session upload progress, just two days after releasing emergency updates for the critical PHP2Shell vulnerabilities. The project describes the new issue as unlikely in practice and is advising administrators to disable the feature temporarily rather than issue another emergency release. PHP’s notice says the full advisory and fix are planned for the next regular bugfix release. [17]
The vulnerability requires an unusual combination of application behavior and configuration. An application must configure session.serialize_handler as php_binary or php_serialize, switch it to php at runtime with ini_set() before calling session_start(), and leave session upload progress enabled. Under those conditions, attacker-controlled upload-progress data can be written to a session and interpreted using a different serialization format, creating a potential path to code execution.
The issue affects even the PHP branches covered by this week’s emergency updates, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Those releases addressed CVE-2026-109618 and CVE-2026-109619, the two PHP2Shell flaws, but do not remediate CVE-2026-115560. The NIST National Vulnerability Database entry does not yet provide a finalized severity rating or affected-version range, so there is currently no authoritative CVSS score for the new issue. [16]
PHP recommends setting session.upload_progress.enabled=0 until the next regular bugfix release. Applications that never change the session serializer at runtime are not exposed to this particular attack path, according to the project, but defenders should still review both PHP configuration and application code rather than assume that a fully patched PHP package eliminates the risk.
Security researchers have published proof-of-concept material describing the serializer-confusion technique, although the available evidence does not establish exploitation in the wild or attribution to a threat actor. The issue is also distinct from PHP2Shell: administrators should retain the emergency updates for those critical flaws while applying the temporary configuration change for CVE-2026-115560. [19]
PHP’s emergency releases for PHP2Shell were published on Oct. 21, with fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations running end-of-life PHP branches should migrate to a supported release, while all operators should restart PHP workers after changing the upload-progress setting and monitor for the routine release that permanently addresses the new vulnerability. [12]
