PHP Discloses Another Remote Code Execution Vulnerability Following Emergency PHP2Shell Patches
October 23, 2026
Just two days after releasing emergency security updates for two critical PHP vulnerabilities, the PHP development team has disclosed another remote code execution (RCE) flaw, CVE-2026-115560.
Unlike the earlier PHP2Shell vulnerabilities, this newly identified issue affects a narrow set of application configurations and is considered unlikely to be exploitable in most environments. However, it is not addressed by the emergency updates released on October 21, and organizations with potentially affected PHP applications should review their configurations.
The disclosure comes as researchers continue to observe widespread attempts to exploit the two earlier vulnerabilities, highlighting the importance of both timely patching and ongoing monitoring.
What Has Changed?
On October 21, PHP released emergency updates addressing two critical vulnerabilities:
- CVE-2026-109618: A remote code execution vulnerability involving memory corruption during out-of-memory handling.
- CVE-2026-109619: A remote code execution vulnerability involving stale internal application state.
Both received CVSS v4.0 severity scores of 9.2 and could allow unauthenticated attackers to execute code on vulnerable servers.
The emergency fixes were released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
On October 23, PHP disclosed CVE-2026-115560, a separate remote code execution vulnerability that remains unpatched. The development team plans to address it through its regular release cycle rather than issuing another emergency update.
Understanding the New Vulnerability
CVE-2026-115560 involves a specific combination of PHP session configuration settings.
For an application to be exposed, several conditions must exist simultaneously:
- The application initially uses
php_binaryorphp_serializeas its session serialization handler. - The application changes that setting to
phpduring execution usingini_set(). - The configuration change occurs before
session_start()is called. - PHP's session upload progress feature remains enabled.
This combination is considered uncommon, which significantly limits the number of applications likely to be affected.
PHP has not yet published a severity score, a complete list of affected versions, or a confirmed release date for the fix. No exploitation of this newly disclosed vulnerability has been reported.
Recommended Actions for Organizations
Although the latest vulnerability has a narrower exposure than the original PHP2Shell flaws, administrators should verify whether their applications meet the affected conditions.
1. Confirm emergency PHP2Shell updates have been applied.
Organizations should ensure their PHP installations have received the October 21 security fixes. The newly disclosed issue does not replace the need to remediate CVE-2026-109618 and CVE-2026-109619.
2. Review session configuration settings.
Identify applications that modify their session serialization handler during execution, particularly those that change from php_binary or php_serialize to php before starting a session.
3. Disable session upload progress where appropriate.
PHP recommends disabling the session upload progress feature as a temporary mitigation:
session.upload_progress.enabled=0
Administrators should assess application dependencies before making configuration changes. Organizations that already applied this mitigation in response to the October 21 advisory do not need to repeat it.
4. Continue monitoring for exploitation attempts.
Security researchers have reported substantial scanning and exploitation attempts targeting the original PHP2Shell vulnerabilities. Organizations should continue reviewing web server logs, investigating suspicious requests, and monitoring internet-facing systems for unusual activity.
5. Track upcoming PHP security releases.
Because CVE-2026-115560 does not yet have an official fix, administrators should follow PHP's security advisories and prepare to deploy the update when it becomes available.
Why Continued Monitoring Matters
The latest disclosure illustrates an important distinction between applying a security update and fully understanding an organization's exposure.
While the October 21 patches addressed two critical vulnerabilities, the discovery of another issue demonstrates why security teams must continue evaluating configuration settings, application dependencies, and newly published advisories even after emergency remediation is complete.
Not every vulnerability carries the same likelihood of exploitation, and not every disclosure requires the same response. Effective vulnerability management means understanding which systems are affected, determining the actual exposure, and prioritizing remediation based on verified risk.
For organizations operating large or complex environments, maintaining an accurate inventory of PHP installations and understanding how applications are configured can make the difference between a manageable security update and an overlooked vulnerability.
Staying Ahead of Emerging Vulnerabilities
Critical Path Security continues to monitor emerging vulnerabilities and developments that may affect organizational security.
Organizations should prioritize patching the original PHP2Shell vulnerabilities, review their exposure to CVE-2026-115560, and monitor official PHP advisories for additional guidance.
Sources:
