PHP has warned of a fresh, unpatched RCE pathway on web servers, just two days after it released emergency fixes for the PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, affects only web applications that are configured in a narrow, unusual way and is considered unlikely to pose broad risk. PHP will not issue an emergency patch for this flaw; instead, it recommends disabling a feature to mitigate exposure until the next routine release. The suggested mitigation is to turn off session upload progress by setting session.upload_progress.enabled=0.
The condition required for CVE-2026-115560 involves a sequence where a web application first sets session.serialize_handler to php_binary or php_serialize in its configuration, then later switches the option to php via ini_set(), with that change occurring before session_start() is called. In practice, PHP notes that only a narrow setup is at risk and that an application that never changes the serialize handler while running is not exposed through this path. No exploitation of CVE-2026-115560 has been reported to date.
Separately, exploitation activity around the earlier PHP2Shell flaws has continued to rise. Amazon’s honeypots reported an attack against CVE-2026-109618 and CVE-2026-109619 as early as 17 October, with Cloudflare noting a surge to millions of attempts within 24 hours of the 21 October disclosure. Attacks have aimed to install a Mirai botnet variant, though researchers indicate no confirmed code execution yet and that exploiting these two flaws remains more complex than expected.