PHP has warned developers about another potential remote code execution (RCE) vulnerability, just two days after releasing emergency patches for two critical security flaws known as PHP2Shell.
The newly identified issue, tracked as CVE-2026-115560, could allow attackers to execute code on a web server under a specific set of application conditions. However, PHP considers the risk unlikely because the vulnerable configuration is uncommon. The project has not released an emergency patch for this issue.
According to reports, PHP disclosed the vulnerability in an informational advisory published on October 23, 2026. The project recommends disabling a particular session feature until a fix arrives in a regular release.
The vulnerability does not affect every PHP application. It requires a specific combination of settings and application behavior. An application must initially configure the "session.serialize_handler" option as either "php_binary" or "php_serialize", then change it to "php" while running through the "ini_set()" function. This change must happen before the application calls "session_start()".
The session upload progress feature must also remain enabled for the reported attack path to apply. According to PHP, this combination is unlikely to occur in typical applications. However, developers should review their configurations to determine whether their systems could be exposed.
Until the vulnerability is fixed, PHP recommends setting "session.upload_progress.enabled=0". This disables session upload progress, a feature that allows applications to track the progress of file uploads.
Administrators who already disabled this feature while responding to the earlier PHP2Shell vulnerabilities do not need to take additional action for this particular attack path.
PHP has not yet specified the affected software versions, assigned a severity score, or confirmed which release will contain the fix. The project plans to provide further technical details alongside the routine update.
Also Read: Common PHP Development Mistakes Every Business Should Avoid
The latest warning follows PHP's October 21 release of emergency updates for CVE-2026-109618 and CVE-2026-109619. These critical vulnerabilities could let unauthenticated attackers execute code on vulnerable servers.
PHP released fixes for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The newly disclosed CVE-2026-115560 is separate and is not addressed by those updates.
PHP has not reported exploitation of the new vulnerability. Administrators should review their application settings, disable session upload progress where appropriate, and monitor official PHP security advisories for further updates.