PHP warns of rare RCE flaw and advises disabling upload progress

The maintainers of PHP have warned of a new remote code execution (RCE) vulnerability, CVE-2026-115560, which they say is unlikely to affect most environments due to requiring a rare configuration and code path.

In an advisory published on 23 October 2026, PHP explained that exploitation would require an unusual sequence: an application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(); session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. The advisory notes that the flaw is likely to affect only a small share of the userbase, and that patched code will arrive with the next release.

Administrators are advised to apply mitigation published on 21 October 2026 as part of the PHP advisories for CVE-2026-109619, a separate maximum severity flaw. PHP recommends setting session.upload_progress.enabled=0 until the next bugfix release to fully protect against the unlikely RCE vector; if it has already been applied, organisations should keep it in place.

The report records that two maximum severity flaws—CVE-2026-109618 and CVE-2026-109619, collectively known as “P2PShell”—triggered widespread outages as patches were prepared. AWS subsequently disclosed that an unknown actor attempted exploitation four days before the official publication of the patches. PHP is used on roughly 70% of global websites, including WordPress, Drupal, Joomla and Magento, making timely mitigation a broad concern. The article attributes the advisories and statements to the PHP security team and to industry commentary reported by Infosecurity Magazine.