PHP’s nightmare is far from over: new unpatched vulnerability found
The severity score is still unknown.
Image by Cybernews
Follow us
- The PHP Foundation says developers should disable session upload progress until the next PHP release.
- The new CVE-2026-115560 flaw could let attackers run code on servers with unusual PHP session settings.
- No exploitation of the new flaw has been reported yet.
- Exploit attempts against earlier PHP2Shell flaws reached millions, but researchers report no confirmed compromises.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
After the PHP Foundation released urgent patches on Wednesday to fix critical flaws in the code that runs two-thirds of the world’s internet, Friday shook the cybersecurity community with yet another unpatched vulnerability discovered in PHP.
The PHP Foundation is urging developers to disable a feature in PHP applications to guard against one more newly identified remote code execution (RCE) vulnerability.
In an advisory published on October 23rd, the foundation recommended disabling session upload progress.
The foundation also shared the recommendation on X, telling users to keep the setting disabled until the next PHP release.
Another vulnerability that enables remote code execution
This precaution addresses the CVE-2026-115560 vulnerability. The good news is that the risk appears limited.
CVE-2026-115560 could allow attackers to execute code on a server, but only when an application uses an unusual combination of PHP session settings. Most applications are unlikely to be affected.
Developers can set this in their PHP configuration: “session.upload_progress.enabled=0.”
The advice is not entirely new. PHP had already recommended the same mitigation in an October 21st advisory covering CVE-2026-109619, one of a pair of critical vulnerabilities involved in the recent PHP2Shell security incident.
Developers who have already applied the setting do not need to take further action for this newly identified issue, according to the foundation.
The foundation has not yet specified which PHP versions are affected or published a severity score. The foundation plans to issue a full advisory alongside the next regular release.
“Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release,” the foundation wrote in the advisory.
No exploitation of this newly discovered vulnerability has been reported.
Attacks against PHP accelerate
Meanwhile, the PHP2Shell exploits accelerate. Amazon reported that its honeypots recorded an exploitation attempt targeting CVE-2026-109618 and CVE-2026-109619 on October 17th, 4 days before the flaws were publicly disclosed.
The activity accelerated after the October 21st disclosure. Cloudflare reported that attempts to exploit the vulnerabilities climbed from tens of thousands within 45 minutes to millions by early October 22nd.
However, no successful attacks have been confirmed.
“There is no evidence of a successful compromise due to these vulnerabilities,” cybersecurity firm Sophos said.
"At the time of writing, we've observed no successful remote code execution and no dropped PHP files. Reliable RCE may be harder to achieve than initially expected," cybersecurity researchers at Previdian said.
