PHP Issues Mitigation Advice for New RCE Flaw CVE-2026-115560

The maintainers of the PHP programming language have issued an advisory regarding a new remote code execution (RCE) vulnerability, though they suggest the flaw is only exploitable under specific and unusual configuration settings. The issue, tracked as CVE-2026-115560, will not receive a formal patch until the next scheduled bugfix release.

According to the PHP security team, the vulnerability arises when an application handles session serialisation in a specific manner. For a successful exploit to occur, a system must have session.serialize_handler set to either php_binary or php_serialize within its primary configuration, and then switch this setting to php at runtime using ini_set() before calling session_start().

Furthermore, the session.upload_progress.enabled feature must remain active for the attack vector to be viable. PHP maintainers noted that applications that do not change their serialisation handler during runtime are not considered at risk from this specific vector.

Mitigation and Security Recommendations

As a definitive patch is currently pending, administrators are advised to implement immediate mitigations. The recommended course of action is to set session.upload_progress.enabled=0 in the PHP configuration. This step is identical to the advice provided earlier this month for a separate maximum-severity flaw, CVE-2026-109619.

Security teams that already applied mitigations during the previous week’s security incidents do not need to take further action. The PHP security team confirmed that the existing mitigation fully protects against this unlikely RCE vector until the next regular update is released.

Context of Recent PHP Security Incidents

The disclosure of CVE-2026-115560 follows a period of significant disruption for web administrators. The previous week saw the emergence of two maximum-severity vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to by some researchers as “P2PShell.” These flaws prompted widespread emergency patching efforts across the 70% of global websites that rely on PHP.

The urgency of these updates was compounded when details of the P2PShell vulnerabilities were accidentally leaked 24 hours before the scheduled patch release. Amazon Web Services (AWS) later reported detecting exploitation attempts targeting these flaws four days before they were officially disclosed, indicating that threat actors may have obtained early access to vulnerability details.

Industry experts suggest that the succession of warnings has placed a significant strain on security operations. The need for precise coordination between risk assessment teams and those authorised to modify live production services remains a primary bottleneck during such high-frequency vulnerability cycles.