PHP issues workaround for unpatched code-execution flaw
The PHP project published workaround guidance for CVE-2026-115560, an unpatched remote code execution flaw that requires an uncommon runtime change to the session serialization handler plus upload-progress support. Until a fix arrives in a regular release, the team recommends turning off session.upload_progress.enabled. The advisory also follows emergency patches for separate PHP2Shell flaws that attackers had begun probing before fixes were available.
PHP underpins close to 70% of websites, and VirusTotal data cited in the advisory estimates over 5.1 million PHP hosts are reachable online, with about 3.8 million exposing at least one open port. CVE-2026-115560 is exploitable only when an application starts with php_binary or php_serialize as its session serializer, switches to php at runtime via ini_set() before session_start(), and keeps upload-progress support active.
The suggested stopgap is to disable session.upload_progress.enabled; organizations that already did so need no further step. Separately, PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 were patched Wednesday after pre-patch probing. Amazon reported attempts four days early, while Dataminr saw scanning and non-working exploits but no confirmed compromises.
The flaw may mainly affect organizations running PHP applications with the rare runtime serializer switch and upload-progress enabled; many site operators could remain unaffected unless configured that way. Because PHP supports a large share of websites, even narrow bugs can prompt broad patching and monitoring. Attackers probing PHP2Shell before fixes could increase pressure on administrators, potentially raising risk for users of vulnerable services through service disruption or data exposure, though confirmed harm remains uncertain.