PHP shares mitigation for new RCE vulnerability with no patch
Read original article ↗AI Summary
The PHP security team has disclosed a new unpatched remote code execution vulnerability, CVE-2026-115560, affecting systems with specific non-default configurations involving session serialization handlers and upload progress enabled. Exploitation requires a rare combination of runtime configuration changes, making widespread impact unlikely, but mitigation is advised. As a temporary measure, users are urged to disable session.upload_progress.enabled. Concurrently, active exploitation attempts are being observed in the wild against previously patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), with multiple actors attempting attacks before patches were released, though confirmed compromises remain unverified.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.