The PHP security team has warned of a new remote code execution (RCE) vulnerability, CVE-2026-115560, but says it will likely affect only a small share of users.

 

What happened

In an advisory published on October 23, the PHP security team said it would not patch CVE-2026-115560 until the next release, because most environments lack the conditions needed to exploit it. The team told administrators to apply the mitigation it recommended on October 21 for CVE-2026-109619, one of two maximum severity flaws disclosed last week.

 

The backstory

Last week, administrators rushed to patch two maximum severity zero days, CVE-2026-109618 and CVE-2026-109619, collectively known as “P2PShell.” The rush caused widespread website outages. Details of the vulnerabilities were accidentally disclosed a day before the patches were due for release. Amazon Web Services later revealed that an unknown threat actor tried to exploit the bugs four days before they were officially published. It remains unclear how the actor obtained the information needed to attempt the attack.

Read also: AI-discovered PHP flaws prompt UK review as attackers probe Amazon systems

 

What was said

The PHP security team explained the narrow conditions in its advisory, “The issue can only occur under an unusual combination of configuration and application code.” It added that applications that never change the serialize handler at runtime can keep the feature enabled.

On the mitigation, the team said: “We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.” It also said, “If you applied it [last week], keep it in place and no further action is needed.”

 

Why it matters

PHP runs around 70% of global websites, including content management systems like WordPress, Drupal, Joomla and Magento, so even a flaw that affects a small share of users can reach many sites. This new flaw also arrives while security teams are still recovering from P2PShell. Administrators who fought outages last week now face another warning. The exploitation attempt that predated disclosure, with no explanation yet of how the attacker got the details, shows how little warning defenders may have.

 

The bottom line

Administrators who applied the October 21 mitigation last week need to do nothing more. Everyone else should set session.upload_progress.enabled=0 now and keep it in place until the next regular bugfix release.

Related: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is remote code execution (RCE)?

RCE is a type of vulnerability that lets an attacker run their own commands on a system from a distance, often without needing physical or direct access.

 

What is the difference between a mitigation and a patch?

A mitigation reduces the risk of a flaw through a workaround, such as changing a setting, while a patch fixes the code.

 

What is PHP?

PHP is a widely used open-source scripting language that powers a large share of websites and web applications.