CVE-2026-115560: PHP's New Unpatched RCE, and the Exposure Window Just Got Longer

What happened

On October 21, 2026, PHP shipped emergency releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for the two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Attack traffic climbed into the millions within a day.

Two days later, on October 23, PHP disclosed a third flaw: CVE-2026-115560, a remote code execution (RCE) vulnerability in the session subsystem. The October 21 releases do not fix it. There is no emergency patch. The fix will arrive with PHP’s next regular bugfix release, along with the full advisory.

Why this one is different

Let’s be clear: this flaw is far narrower than PHP2Shell. An application is only exposed when all three of these conditions are met:

1. Configuration: session.serialize_handler is set to php_binary or php_serialize.

2. Code: the application switches it back to php at runtime with ini_set(), before calling session_start().

3. Default left on: session.upload_progress.enabled is still enabled, which is PHP’s default.

PHP itself calls this setup unlikely. No exploitation has been reported. But “unlikely” is not “impossible”, and there are two catches:

• The risky call may not be in your code. It can sit in a Composer dependency under vendor/, where few teams ever look.

• Almost everything is still unknown. Affected versions, CVSS score and root cause have not been published. Attackers are reading the same advisory you are, and the PHP session subsystem is now the most scrutinized code on the web.

For decision makers: three things to do this week

1. Ask whether PHP2Shell is fully patched. Every server, every environment. CVE-2026-115560 is not a reason to slow down on the flaws already under active attack.

2. Ask whether the mitigation is applied everywhere. One configuration line covers both CVE-2026-109619 and this new flaw. Confirm it is live, not just planned.

3. Ask how long you stay exposed. This is the third PHP RCE in three days, and the next fix depends on PHP’s release calendar, not yours. If your only defense is the patch, your exposure window is set by someone else.

For technical teams: check and mitigate

Check your exposure

Search configuration and code, including vendor/, for any reference to the session serializer:

grep -rn "serialize_handler" /etc/php* /etc/httpd /etc/apache2 2>/dev/null
grep -rn "serialize_handler" /var/www --include="*.php" --include=".htaccess" --include=".user.ini"

Then confirm the live values on each runtime, since CLI and FPM can differ:

php -i | grep -E "session.serialize_handler|session.upload_progress.enabled"

You are a likely candidate if config shows php_binary or php_serialize and code calls ini_set('session.serialize_handler', 'php'). PHP has not said whether php_value overrides in .htaccess or .user.ini trigger the same path, so treat them as suspect.

Mitigate today

session.upload_progress.enabled = 0

• Set it in php.ini, the PHP-FPM pool or the web server configuration. Do not rely on ini_set() or .user.ini.

• Restart every PHP worker, then verify with php -i or phpinfo() from the pool your app actually uses.

• If you already applied it on October 21 for PHP2Shell, leave it in place.

• Expect native upload progress bars to stop working. Most modern front ends track progress client-side.

Where CYBERDEFENSE.AI fits

Three PHP RCE flaws in three days, one of them still unpatched. Every traditional control in that sequence waited for something: a patch, a signature, a new blocking rule, a configuration change. Each wait is an exposure window, and attackers move fastest inside it.

CYBERDEFENSE.AI’s preemptive WAF does not wait. It uses artificial intelligence to analyze application behavior in real time, without signatures, rules or reactive patches. That means:

• No update was needed for PHP2Shell, and none is needed for CVE-2026-115560. Protection was already in place before either was disclosed.

• Exploitation attempts stand out as abnormal behavior. Automated scanners sweeping thousands of sites and requests that do not match how your application is normally used are flagged and blocked.

• Threat intelligence is shared across the platform. IPs already caught attacking elsewhere are stopped before they reach you.

A layer, not a substitute: keep patching. But with a preemptive defense in front of your applications, the time between disclosure and remediation stops being time you spend exposed.

Key takeaways

• CVE-2026-115560 is a new, unpatched PHP RCE. The PHP2Shell patches do not cover it.

• Exposure requires a specific session configuration, but the triggering code can hide in third-party dependencies.

• Set session.upload_progress.enabled=0 at the server level today, and patch when PHP’s next release ships.

• Patch-driven security leaves you exposed for as long as the patch takes. Preemptive protection closes that window.