PHP Warns of Another Remote Code Execution Flaw, but Says Few Systems Are at Risk

The maintainers of the PHP programming language have warned of a new remote code execution vulnerability, tracked as CVE-2026-115560. In an advisory published on October 23, the PHP security team said the flaw will not be patched until the next regular release. It argued that the conditions needed to exploit it are not present in most environments.

According to the advisory, the issue only occurs under an unusual combination of configuration and application code. An application must set a particular session serialisation setting, switch it to a different one while running, and still have session upload progress enabled. Administrators are urged to apply the mitigation first recommended on October 21 for CVE-2026-109619: set session.upload_progress.enabled=0 until the next bugfix release. Anyone who applied it last week does not need to do anything further.

The warning follows a difficult week. Administrators faced widespread website outages while patching two maximum severity zero day flaws, collectively known as PHP2Shell. Details were accidentally disclosed a day before patches were due, and Amazon Web Services later said an unknown threat actor tried to exploit the bugs four days before official publication. It is unclear how the attacker obtained the information. Mike Lyborg, CISO at Swimlane, said the new flaw needs a precise response, and noted that a bottleneck could be the handoff between those assessing risk and those authorised to change a live service.