PHP Warns of Two Critical Vulnerabilities, Emergency Patches Due Today at 14:00 UTC
The PHP team has warned of two critical flaws rated CVSS 9.2. Patches are due October 21 at 14:00 UTC, so admins should get their updates ready now.
Vulnerabilities
New PHP RCE Flaw CVE-2026-115560 Isn't Fixed by the PHP2Shell Patches
A new PHP flaw, CVE-2026-115560, affects an unusual session setup. Until a fix ships, PHP advises disabling file upload progress tracking.
On October 23, the PHP project issued a warning about a new remote code execution flaw, tracked as CVE-2026-115560. The patches released on October 21 don’t fix it. However, the flaw can only be exploited with a rare combination of settings and application behavior. Until the next regular release, PHP’s developers recommend a configuration change to block it.
What’s new since PHP2Shell
This is an important update to the earlier PHP2Shell reports. The new CVE covers another way to execute code that the patches already released don’t address. The Canadian Centre for Cyber Security confirmed this in an October 23 update to its advisory.
PHP recommends setting session.upload_progress.enabled=0. This setting turns off session-based file upload progress tracking. It was already one of the recommended workarounds for the earlier vulnerability. If administrators applied it and left it in place, PHP says no further change is needed for CVE-2026-115560.
When an application is exposed
An application is exposed only if session.serialize_handler is set to php_binary or php_serialize and the application then switches it to php with ini_set() before calling session_start(). File upload progress tracking must also be enabled.
Applications that don’t change how sessions are serialized while running can’t be attacked this way. PHP considers this setup unlikely in practice. For that reason, it will fix the flaw in its regular release cycle rather than ship another emergency release. None of the advisories we reviewed report confirmed attacks exploiting the new flaw.
What to do now
- Review your session settings and look for any place where the application changes
session.serialize_handler. - On exposed installations, set
session.upload_progress.enabled=0in the PHP configuration. - Confirm that the setting is active in the running environment, and test that file uploads still work.
- Keep the earlier PHP updates installed, and watch for the release announcement that includes the fix for the new flaw.
SecurHUB’s take
After an urgent update, it’s worth taking another look at your configuration and at how your applications use the affected features. Security audits help you connect vendor advisories to the way your services actually run.
Sources: PHP — October 23 announcement, Canadian Centre for Cyber Security — advisory update
