GoKawiilPHP discloses unpatched RCE flaw, offers mitigation instead of patch
The PHP security team issued an advisory for CVE-2026-115560, a remote code execution vulnerability that only affects systems with a specific non-default configuration involving session serialize handlers and session upload progress. No patch exists yet; PHP maintainers instead recommend disabling session.upload_progress as a temporary mitigation, with a full fix expected in a future regular release. This follows closely behind PHP's patching of two other critical flaws collectively called PHP2Shell.
GoKawiil's interpretation of the reporting above, not reported fact.
PHP powers nearly 70% of websites, and VirusTotal data cited in the advisory shows millions of exposed hosts, so even a narrow configuration-dependent flaw could affect a meaningful number of real-world deployments. The PHP team's decision to treat this as low-urgency and fold it into the normal release cycle suggests it judges the specific misconfiguration required to be uncommon, though that assumption could prove wrong if attackers find affected setups. The timing, right after PHP2Shell exploitation attempts were observed by multiple security firms, may increase scrutiny on PHP's handling of session-related vulnerabilities generally.
- CVE-2026-115560 is an unpatched PHP RCE flaw requiring a rare configuration involving runtime-switched session serialize handlers.
- PHP recommends setting session.upload_progress.enabled=0 as a stopgap mitigation until a full patch ships.
- The disclosure comes shortly after PHP patched two other critical RCE bugs, known as PHP2Shell, which saw real exploitation attempts.
Source: bleepingcomputer.com, 2026-10-23
Published there as: “PHP shares mitigation for new RCE vulnerability with no patch”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.