New PHP flaw CVE-2026-115560: the PHP2Shell update doesn't fix it
On October 23, 2026, PHP disclosed CVE-2026-115560, a new remote code execution (RCE) vulnerability. It is separate from the PHP2Shell flaws patched two days earlier, and there is no fix for it yet. Only applications with an unusual configuration are exposed, and PHP considers exploitation unlikely. The mitigation is one line: session.upload_progress.enabled=0. If you set it for PHP2Shell on October 21 and left it in place, you don't need to do anything else.
Is my server affected?
According to PHP, the issue only occurs when three conditions are all true:
-
session.serialize_handleris set tophp_binaryorphp_serializein php.ini or another configuration file. -
The application switches it to
phpwithini_set()before callingsession_start(). -
session.upload_progress.enabledis on, which is the PHP default.
A default installation already uses php as the serializer, so the first condition doesn't apply. Applications that never change the serializer at runtime are not exposed through this path, even with upload progress enabled.
To check whether your code changes this setting, search the project directory. Include the vendor directory, since third-party packages can change it too.
grep -rn "serialize_handler" /var/www/your-project
Does the PHP2Shell update fix this?
No. On October 21, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixed CVE-2026-109618 and CVE-2026-109619. PHP is shipping the fix for the new issue in its next regular release instead of as an emergency patch, and will publish the full advisory with that release.
As The Hacker News points out, PHP has not yet said which versions are affected, which release will carry the fix, or how severe the issue is. It also hasn't said whether it shares a root cause with CVE-2026-109619. Both involve session upload progress, and PHP's October 21 advisory already listed the same setting as a mitigation for CVE-2026-109619.
What should I do?
Turn the setting off somewhere the application can't override it: php.ini, the PHP-FPM pool, or the web server configuration. PHP advises against relying on ini_set() or an FPM .user.ini file.
; php.ini
session.upload_progress.enabled = 0
; or in the PHP-FPM pool file (e.g. www.conf)
php_admin_flag[session.upload_progress.enabled] = off
Then restart every PHP worker. Confirm the change on a phpinfo() page served by your web server. Running php -i on the command line can read a different php.ini and show the wrong value.
With the setting off, PHP stops writing upload progress into the session. Progress bars that read from it will stay still, but file uploads keep working.
If you still haven't installed the PHP2Shell update, do that first. The Hacker News reports that attacks seen since October 21 target the PHP2Shell flaws, and Sophos and Arctic Wolf say attackers have tried to use them to install a Mirai botnet variant. No exploitation of CVE-2026-115560 has been reported.
FAQ
I'm on shared hosting. What can I do?
If you can't edit php.ini, ask your hosting provider whether they have disabled the setting at the server level. A .user.ini file in your own directory is not the mitigation PHP recommends.
When will the fix be released?
PHP hasn't given a date. The fix will come in the next regular bugfix release. If you don't use upload progress, you can keep it off after updating as well.
I run WordPress or Laravel. Am I affected?
That depends on the three conditions above, not on the software you run. If the serialize_handler search returns nothing and the server keeps the default value, this issue doesn't affect you.
If you'd like us to review the PHP configuration on your servers or plan a version upgrade, get in touch with the SUNS Technology team.
