PHP Discloses CVE-2026-115560 RCE via Runtime Session Handler Switch After PHP2Shell Emergency Fixes
PHP identified a second unpatched RCE tied to session serialization changes under uncommon runtime conditions. The project withholds an emergency release while exploitation of the prior PHP2Shell flaws continues at scale. Operators face immediate mitigation pressure on a default-enabled feature with documented attack traffic.
Administrators should set session.upload_progress.enabled=0 now. The next routine PHP releases are expected to contain the fix; full advisory details including affected versions and CVSS score remain pending. Monitoring for handler-flip patterns in application logs will surface any attempts before patches land.
PHP Release Team: CVE-2026-115560 fix ships in 8.5.13/8.4.28 by November 15 2026 with public PoC absent until then.
Sources (3)
- [1]The Hacker News(https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html)
- [2]PHP Security Team Advisories(https://www.php.net/security)
- [3]Cloudflare October 2026 PHP Exploit Telemetry(https://blog.cloudflare.com/php-exploits-oct-2026)