The PHP security team issued an advisory for CVE-2026-115560, a remote code execution vulnerability that only affects systems with a specific non-default configuration involving session serialize handlers and session upload progress. No patch exists yet; PHP maintainers instead recommend disabling session.upload_progress as a temporary mitigation, with a full fix expected in a future regular release. This follows closely behind PHP's patching of two other critical flaws collectively called PHP2Shell.
bleepingcomputer.com
· 2026-10-23
The PHP team released PHP 8.6.0 RC4, the third release candidate in the 8.6 cycle, which patches two critical vulnerabilities that could allow unauthenticated remote code execution. Users running earlier 8.6.0 builds are urged to update immediately, though the team stresses RC4 remains a test build not meant for production use. A further release candidate, RC5, is planned for 5 November 2026.
php.net
· 2026-10-23
Security researchers have disclosed two PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP web runtimes, along with a suggested AWS WAF rule named 'PHP2Shell' to help block exploitation attempts. The rule targets POST requests that combine PHPSESSID cookie or body values with the PHP_SESSION_UPLOAD_PROGRESS parameter, a pattern associated with session-based remote code execution attacks against PHP applications.
aws.amazon.com
· 2026-10-21
GoKawiil