PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
Read original article ↗AI Summary
PHP has disclosed an unpatched remote code execution (RCE) vulnerability, CVE-2026-115560, affecting systems with a specific and uncommon configuration involving session upload progress and dynamic changes to session.serialize_handler. The vulnerability arises when applications change the session handler to 'php' at runtime via ini_set() before session_start(), while session.upload_progress.enabled is still active. Although no exploitation has been observed, PHP recommends disabling session.upload_progress.enabled as a mitigation until a fix is included in the next routine release. This follows emergency patches for two critical PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619), which are already under active exploitation.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.