Threat Intelligence

PHP Flags Another Remote Code Flaw Days After Emergency Patches, With a One-Line Workaround

The Hacker News · 23 Oct 2026

Key Takeaway Make sure the October 21 PHP updates are installed and set session.upload_progress.enabled=0 on your web servers until PHP releases a fix for the new issue.

PHP has warned of another way an attacker could run code on a web server, just two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, CVE-2026-115560, was described in a short advisory on October 23. PHP considers the risk unlikely and is not issuing an emergency fix. A full advisory will be published with the next routine release.

Only a narrow setup is exposed. A web application must set the session.serialize_handler option to php_binary or php_serialize, change it to php while running using ini_set(), and do so before calling session_start(). Session upload progress, a feature that is on by default and tracks file uploads, must also still be enabled. The earlier emergency releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) fixed CVE-2026-109618 and CVE-2026-109619, but they do not fix this new issue.

PHP recommends setting session.upload_progress.enabled=0 until a fix ships. This is the same mitigation it listed on October 21 for CVE-2026-109619, so anyone who already applied it needs to do nothing more. PHP has not said which versions are affected, when the fix will land, or how severe the issue is, and it has not confirmed whether it shares a root cause with CVE-2026-109619. No exploitation of the new issue has been reported; attacks seen since October 21 target the two earlier PHP2Shell flaws.

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.