PHP disclosed a new remote code execution vulnerability, identified as CVE-2026-115560, just two days after releasing emergency patches for critical PHP2Shell flaws. The newly discovered issue affects only web applications with specific configurations and is considered an unlikely risk. Rather than issuing an emergency fix, PHP recommends disabling the session upload progress feature until a regular patch becomes available in the next scheduled release.
The vulnerability requires a narrow set of circumstances to occur, including specific configuration changes to the session serialization handler and the session upload progress feature being enabled. PHP stated this setup is uncommon in practice. Users who previously disabled session upload progress as a mitigation for earlier PHP2Shell flaws need not take additional action. No active exploitation of this new vulnerability has been reported, unlike the two earlier PHP2Shell flaws, which have experienced millions of exploitation attempts since their October 21 disclosure.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
