Two days after its emergency PHP2Shell patches, the PHP project published an informational advisory for another way to run code on a web server, CVE-2026-115560. According to The Hacker News, it is a separate issue that the October 21 releases do not fix, but it only affects applications configured in an unusual way, so PHP considers it unlikely in practice and is not issuing an emergency fix. The fix will come in the next routine release, along with a full advisory.
An application is exposed only if it does all of the following: sets session.serialize_handler to php_binary or php_serialize in its configuration, changes it to php while running by calling ini_set(), and does that before calling session_start(). Session upload progress, a feature that is on by default and lets an application track file uploads, must also still be enabled. An application that never changes the serialize handler at runtime can leave the feature on and is not exposed through this path. PHP has not stated which versions are affected, which releases will carry the fix, or a severity score, and has not said whether the flaw shares a root cause with PHP2Shell’s CVE-2026-109619. No exploitation of CVE-2026-115560 has been reported; the attacks seen since October 21 target the two earlier flaws, as covered in our post on Amazon’s findings.
How to check if you’re affected
Affected versions have not been published by PHP, so treat any PHP installation, including ones already updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as potentially in scope until the full advisory appears. Search your application code and configuration for session.serialize_handler set to php_binary or php_serialize, and for ini_set('session.serialize_handler', ...) calls made before session_start(); if you find neither, the described setup does not apply.
- PHP recommends setting
session.upload_progress.enabled=0until the next routine release. It is the same setting PHP already listed as a mitigation for CVE-2026-109619 in its October 21 advisory, so anyone who applied it then needs to do nothing more. - Turning it off stops applications from tracking upload progress; check whether yours uses that feature first.
- Keep applying the October 21 updates for the two PHP2Shell flaws; they are still the actively targeted ones.