PHP Discloses New Unpatched RCE Flaw Two Days After PHP2Shell Emergency

The PHP project disclosed a new unpatched RCE vulnerability, CVE-2026-115560, on October 23, 2026. The date falls just two days after emergency patches fixed the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. The same temporary mitigation already recommended for the previous flaws — disabling session.upload_progress.enabled — also protects against this new variant. The language powers roughly 70% of websites worldwide.

The Sequence: 48 Hours Between Patches and New Disclosure

On October 21, 2026, PHP shipped emergency patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixing CVE-2026-109618 and CVE-2026-109619. Both previous vulnerabilities received a CVSS 9.2 (v4.0) score. On October 23, while administrators were still verifying updates, PHP disclosed CVE-2026-115560.

No exploits have been reported for this new flaw. Observed attacks since October 21 target only the two previous CVEs. The October 21 patches do not fix 115560, and PHP chose not to accelerate the release cycle. The separation is explicit: three CVE identifiers in 48 hours, all tied to the same session upload progress functionality.

The Mechanism: Unreset Global State

The technical core lies in session serializer handling. According to the description reported by BleepingComputer, citing the PHP team:

"An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled"

This specific sequence leaves an unreset global state in the session engine. Interaction with the upload progress tracking mechanism can lead to use-after-free and consequent remote code execution.

The mechanism resembles the stale global state documented for CVE-2026-109619 in GitHub Security Advisory GHSA-6wmf-4rv5-p3rp. PHP has not confirmed whether the two flaws share the same root cause. The vulnerable configuration requires the application to modify the serializer at runtime, an uncommon practice in most PHP codebases. This underpins the project's "unlikely" risk assessment.

Verifiable Facts and Analysis Context

Three verifiable facts emerge from available documentation. First: 48 hours separate the October 21 emergency patches from the disclosure of the new unpatched vulnerability. Second: the same mitigation protects against both flaws. Third: PHP has not assigned a CVSS score nor listed affected versions for CVE-2026-115560, leaving security teams without standard prioritization tools.

This information asymmetry is significant. Enterprise security teams rely on CVSS scores and version matrices to orchestrate patching and monitoring. Their absence for CVE-2026-115560 forces decisions based on qualitative configuration descriptions, a format that does not scale in automated workflows. PHP has communicated that the fix will arrive in the next routine release, without indicating a date.

What to Do Now

• Verify the status of session.upload_progress.enabled in php.ini or virtual host configurations: if already set to 0 for the PHP2Shell mitigation, no additional action is required
• Check for use of ini_set('session.serialize_handler', 'php') in your codebase: the vulnerable configuration explicitly requires this call sequence
• Plan the upgrade to the next routine PHP release without waiting for out-of-cycle patches: the project has confirmed CVE-2026-115560 will be fixed in the next regular release
• Document the lack of CVSS and affected versions in internal ticketing systems: this gap is known and must be managed explicitly in risk assessment cycles

Coverage Limits and Sources

Detailed technical coverage of CVE-2026-115560 relies primarily on The Hacker News and BleepingComputer, with existence confirmation from CERT-EU. A dedicated structured advisory for the new vulnerability is missing: GitHub Security Advisory GHSA-6wmf-4rv5-p3rp covers only CVE-2026-109619. Sources on CVE-2026-115560 are therefore less granular than those available for the previous flaws.

The BleepingComputer quote on the identical mitigation appears in both primary sources with equivalent wording. The PHP team has not issued separate communications for CVE-2026-115560, relying on established security channels.

Why This Story Matters Today

The temporal concentration is unusual. Three CVEs with RCE potential in 48 hours, all tied to the same optional functionality, constitute a pattern the PHP project has not yet explained. The decision not to issue an emergency patch for the third flaw, combined with the absence of CVSS and affected versions, indicates a disclosure approach that privileges internal assessment over transparency to operators.

The same mitigation that protected against PHP2Shell now also protects against CVE-2026-115560. This overlap is an objective fact, not an interpretation: those who had already disabled session upload progress on October 21 need not act. The PHP team communicated this explicitly via BleepingComputer:

"If you applied it then, keep it in place and no further action is needed"

CERT-EU replicated the same recommendation in its v1.2 update on October 23, 2026. The convergence of mitigations does not, however, resolve the information problem: without CVSS and without a version list, security teams cannot calibrate their response with standard industry tools. This is a verifiable condition, not a critique of PHP's process. The project has not stated whether it intends to fill this gap with the routine patch release.

Sources

• thehackernews.com
• cert.europa.eu
• bleepingcomputer.com
• github.com
• wiz.io
• watchtowr.com