PHP security team discovers new remote code execution bug
Summarised from 2 outlets · Updated 26 Oct, 14:19 · Archive
The PHP Security Team has discovered another remote code execution vulnerability in PHP that will not receive an emergency patch.
The PHP Security Team has discovered a new remote code execution vulnerability in PHP, tracked as CVE-2026-115560, related to session upload progress. Unlike recent critical PHP vulnerabilities, this bug will not receive an emergency patch as it requires specific conditions to exploit.
The vulnerability can only be abused under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime using ini_set() before calling session_start(). Session upload progress must also remain enabled. Applications that never change the serialize handler at runtime can safely keep the feature enabled without risk.
The PHP Security Team recommends users set session.upload_progress.enabled=0 until the next regular bugfix release as a mitigation, though they note the conditions required to trigger the vulnerability are unlikely. Users who previously applied this setting to protect against CVE-2026-109619, one of two critical remote code execution vulnerabilities recently discovered in PHP, should continue with the existing mitigation and take no further action.
How it is being reported
- Experts reveal another major PHP2Shell bug — and it's not getting an emergency patch this timeThe bug can trigger remote code execution but only under certain, "unlikely" conditions.TechRadar · 26 Oct, 14:00
- PHP2Shell is a warning shot for vulnerability disclosureKeeping secrets is difficult in an open world, but we've done it before and must do it againThe Register · 26 Oct, 09:38
In this story: PHP Security Team · PHP
This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem
Comments (0)