PHP team shares mitigation for new RCE vulnerability as previous flaws come under attack

CVE-2026-115560 has no patch yet but affects only non-default configurations; PHP2Shell flaws now seeing broad exploitation attempts

By LineZotpaper

Published23 October 2026

Read Time3 min

The PHP security team has published mitigation steps for a newly disclosed remote code execution vulnerability (CVE-2026-115560) affecting non-default configurations, while attackers are already targeting two critical PHP2Shell flaws patched this week. The flaws collectively expose roughly 3.8 million PHP hosts with open ports to potential compromise, according to VirusTotal estimates.

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and currently has no patch. PHP is an open-source web development language used by nearly 70% of all websites on the Internet. According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, with roughly 3.8 million having at least one port open to attacks.

The newly disclosed security flaw, tracked as CVE-2026-115560, can only be exploited on systems with an unusual combination of configuration and application code. According to a Friday advisory, an application must set session.serialize_handler to php_binary or php_serialize in its configuration, then switch it to php at runtime with ini_set() before calling session_start(), with session upload progress still enabled. The PHP team noted that applications that never change the serialize handler at runtime can keep the feature enabled, and said the issue is being handled in the regular release cycle with a full advisory to accompany the next release. Until a security patch is available, the team recommends setting session.upload_progress.enabled=0.

The announcement comes days after the PHP team patched two other critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The PHP2Shell flaws are now seeing active exploitation attempts. Although some proof-of-concept code was published before patches went live, the PHP security team said none were functional. However, multiple cybersecurity companies, including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack, detected unsuccessful exploitation attempts before public disclosure after details of the flaws leaked to some critical infrastructure providers.

Security researchers at Amazon Threat Intelligence also reported that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released on Wednesday. AWS chief information security officer CJ Moses said: "The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems." Moses added that PHP2Shell is now seeing broad exploitation attempts in the wild, though it remains unclear how many attacks, if any, have succeeded.

Dataminr's Threat Research and Cyber Engineering team reported that observed activity since vulnerability disclosure remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises. The team noted that it remains only a matter of time before working PoCs or successful exploitation emerges.

Analysis

Why This Matters

PHP powers nearly 70% of all websites, making vulnerabilities in the language a widespread security concern
With no patch yet for CVE-2026-115560, the mitigation offers only temporary protection; misconfigured or unpatched systems remain at risk
The active exploitation of the PHP2Shell flaws demonstrates that attackers move quickly once vulnerability details are known, increasing pressure on administrators to apply mitigations

Background

PHP is a widely used server-side scripting language. On Friday the PHP team disclosed CVE-2026-115560, a remote code execution flaw affecting uncommon configurations, with a mitigation but no patch. This follows the Wednesday patching of two critical RCE vulnerabilities, PHP2Shell, which were disclosed with advance notice to critical infrastructure providers. Exploitation attempts against PHP2Shell began before patches were available, involving multiple actors scanning and testing non-functional exploits. No successful compromises have been confirmed, but security firms expect working exploits to emerge.

Key Perspectives

PHP Security Team: The vulnerability requires a rare combination of configuration choices and is being handled in the regular release cycle. Applications that do not change the serialize handler at runtime are not affected. The recommended mitigation is to disable session upload progress. Security Researchers: Exploitation attempts against PHP2Shell are broad but remain at the scanning and fingerprinting stage. Multiple threat actors are involved, and working exploits are expected soon once PoC code becomes functional. System Administrators: Should apply the recommended mitigation immediately and remain vigilant for the next PHP release containing a full patch. Those still running vulnerable configurations should review their session handling setup.

What to Watch

Whether working proof-of-concept code for PHP2Shell emerges in the coming days, triggering a wave of actual compromises
The next PHP release cycle: a full advisory for CVE-2026-115560 will accompany the next patch, indicating when a fix will ship
Any additional exploitation attempts targeting CVE-2026-115560 once details spread, despite the mitigation

Sources

PHP shares mitigation for new RCE vulnerability with no patch · BleepingComputer

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

SupportedThe headline says the earlier PHP2Shell flaws have come under attack.BleepingComputer: “PHP2Shell flaws now targeted in attacks”
SupportedCVE-2026-115560 has no patch yet and affects systems with non-default configurations.BleepingComputer: “a new remote code execution vulnerability that affects systems with non-default configurations and has no patch”
SupportedThe PHP2Shell flaws are seeing broad exploitation attempts.BleepingComputer: ““PHP2Shell is now seeing broad exploitation attempts in the wild,” he added”
Partly supportedThe PHP2Shell flaws collectively expose roughly 3.8 million PHP hosts with open ports to potential compromise, according to VirusTotal estimates.BleepingComputer: “According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks.”
SupportedPHP is used by nearly 70% of websites on the internet.BleepingComputer: “PHP is an open-source web development language used by nearly 70% of all websites on the Internet.”
SupportedCVE-2026-115560 requires an unusual combination of configuration and application code, including a runtime change to the session serialize handler and enabled session upload progress.BleepingComputer: “An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled”
SupportedThe PHP team recommends setting session.upload_progress.enabled=0 until a security patch is available.BleepingComputer: “Until a security patch is available, the PHP devs suggested setting session.upload_progress.enabled=0”
SupportedThe AWS CISO said payloads and anonymization choices suggested multiple actors, and that it was unclear whether the attempts would have succeeded in real-world systems.BleepingComputer: ““The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems,” said AWS chief information security officer CJ Moses.”
SupportedAmazon Threat Intelligence researchers said attackers began targeting PHP2Shell four days before patches were released on Wednesday.BleepingComputer: “Security researchers at Amazon Threat Intelligence also said that attackers began targeting the PHP2Shell vulnerabilities four days before security patches were released on Wednesday.”
SupportedThe PHP team said that proof-of-concept code published before the patches went live was not functional.BleepingComputer: “While some proof-of-concept (PoC) code was published before the patches went live, the PHP security team said none were functional.”
SupportedDataminr reported that observed activity since disclosure was limited to scanning, fingerprinting and non-working exploits, with no known compromises.BleepingComputer: “observed activity since vulnerability disclosure remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises”
SupportedDataminr said it was only a matter of time before working proof-of-concepts or successful exploitation emerged.BleepingComputer: “it remains only a matter of time for working POCs or successful exploitation activity to emerge.”