PHP has disclosed a new, unlikely remote code execution flaw, tracked as CVE-2026-115560, appearing just two days after emergency patches for the PHP2Shell flaws. The issue is confined to a narrow configuration scenario: the PHP app must configure session.serialize_handler to php_binary or php_serialize, switch it to php at runtime with ini_set() before calling session_start(), and have session upload progress still enabled.
In this configuration, the vulnerability could theoretically be exploited, though PHP notes that ordinary applications that never perform this runtime switch are not exposed by this attack path. No attacks targeting CVE-2026-115560 have been reported.
PHP’s advisory dated 23 October recommends a simple interim mitigation: disable session upload progress until a regular release with a full fix is available. This vulnerability is separate from the PHP2Shell issues and is not addressed by the 21 October updates for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The project emphasises that the problematic setup is uncommon, and a full advisory for CVE-2026-115560 will accompany the next release.
Administrators who do not alter the session serialize handler at runtime are not affected; those who have already disabled session upload progress should not need further action for this issue. By contrast, the prior PHP2Shell fixes involved widespread, unauthenticated remote code execution via crafted HTTP requests and affected all PHP versions handling web requests, with tens of thousands of exploit attempts observed by Cloudflare researchers after disclosure.