Threat Intelligence & Vulnerability Management
Just two days after emergency security updates addressed the critical PHP2Shell vulnerabilities, the PHP development team disclosed another potential remote code execution (RCE) vulnerability, CVE-2026-115560, affecting PHP's session upload progress functionality.
Unlike the earlier PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), this newly identified issue remains unpatched as of October 23, 2026 and affects applications using a specific, uncommon combination of PHP session configurations.
Although PHP considers exploitation unlikely in typical deployments, successful exploitation under the required conditions could potentially allow attackers to execute malicious code remotely.
Organizations should review their PHP configurations and implement the recommended mitigation until an official security update becomes available.
Understanding CVE-2026-115560
CVE-2026-115560 involves PHP's session upload progress functionality, which tracks file upload progress using session data.
The vulnerability becomes exploitable only when several specific conditions exist simultaneously:
- The application configures
session.serialize_handlerasphp_binaryorphp_serialize. - Application code changes the serialization handler to
phpat runtime usingini_set(). - This change occurs before calling
session_start(). - PHP session upload progress remains enabled.
Under these conditions, improper session-state handling may create a potential remote code execution path.
Applications that do not dynamically change their session serialization handler are not exposed to this specific attack vector.
Why This Vulnerability Matters
Although exploitation requires an uncommon configuration, organizations should not overlook the potential security impact.
Successful exploitation could result in:
- Remote code execution: Unauthorized execution of commands within the PHP server process.
- Application compromise: Attackers gaining control over affected web applications.
- Data exposure: Unauthorized access to sensitive application information.
- Business disruption: Potential interruption of websites and critical business services.
- Lateral movement: Attackers using a compromised web server to target connected infrastructure.
Importantly, the emergency PHP releases issued on October 21, 2026, do not address CVE-2026-115560.
Organizations that have already patched PHP2Shell should still verify whether their applications use the vulnerable configuration.
Affected PHP Versions and Patch Status
As of October 23, 2026, PHP has not published a definitive affected-version list or a confirmed fixed-release number for CVE-2026-115560.
Security DetailCurrent StatusCVE IdentifierCVE-2026-115560Vulnerability TypePotential Remote Code ExecutionAffected ComponentPHP Session Upload ProgressCVSS ScoreNot officially publishedSecurity PatchNot yet availableRecommended FixDisable session upload progressPermanent ResolutionExpected in next regular PHP release
PHP plans to address this vulnerability in its next regular maintenance release rather than issuing another emergency update.
Recommended Mitigation and Security Measures
Fortuna Cysec recommends the following actions.
1. Disable PHP Session Upload Progress
Until an official patch is released, disable the affected feature in the PHP configuration:
session.upload_progress.enabled = 0
Apply the setting in php.ini or an appropriate server-level configuration and restart affected PHP services or workers.
2. Review Application Session Configurations
Identify applications using php_binary or php_serialize session handlers and determine whether application code changes the handler dynamically before starting sessions.
3. Maintain Existing PHP2Shell Patches
Ensure PHP installations remain updated to the security releases addressing CVE-2026-109618 and CVE-2026-109619.
These updates remain essential even though they do not resolve CVE-2026-115560.
4. Strengthen Security Monitoring
Monitor PHP application logs, unusual session activity, unexpected server processes, and suspicious HTTP requests. Maintain updated WAF protections where available.
5. Track the Official Security Update
Monitor PHP security advisories and deploy the permanent fix once the next regular release becomes available.
Organizations that already disabled session upload progress as part of their PHP2Shell mitigation do not need an additional configuration change for this vulnerability.
How Fortuna Cysec Can Help
CVE-2026-115560 demonstrates that applying security patches alone may not eliminate every emerging threat. Continuous visibility, configuration assessment, and proactive monitoring remain essential.
Through the Fortunox Security Operations Platform, Fortuna Cysec combines Continuous Threat Exposure Management (CTEM) and Managed Detection and Response (MDR) to help organizations:
- Identify vulnerabilities: Discover exposed assets, vulnerable configurations, and emerging security risks.
- Prioritize remediation: Assess business impact and coordinate risk-based corrective actions.
- Monitor threats: Detect suspicious activity through 24/7 managed security operations.
- Respond effectively: Investigate incidents and coordinate containment and remediation.
- Maintain resilience: Continuously monitor and improve organizational security posture.
Our integrated security approach helps organizations move beyond reactive patching toward continuous threat exposure reduction.
Final Thoughts: Mitigate Now, Patch When Available
While CVE-2026-115560 requires an uncommon application configuration, its potential remote code execution impact warrants attention.
Organizations should review PHP session configurations, disable session upload progress where appropriate, maintain existing PHP security updates, and monitor for the permanent fix.
Emerging vulnerabilities demand continuous visibility, proactive remediation, and rapid threat detection.
Is Your PHP Environment Secure?
Fortuna Cysec helps organizations identify critical vulnerabilities, assess security exposure, and strengthen cyber resilience through Fortunox CTEM and MDR services.
Contact Fortuna Cysec today to assess your cybersecurity exposure and strengthen your defenses.
