PHP Discloses Unpatched Session RCE Risk After PHP2Shell Emergency Fixes

PHP disclosed CVE-2026-115560, a potential server-side remote code execution vulnerability, two days after its October 21 emergency PHP2Shell patches. The separate, unpatched issue requires an unusual application configuration: changing session.serialize_handler from php_binary or php_serialize to php at runtime before calling session_start(), while session upload progress remains enabled. PHP recommends disabling session.upload_progress.enabled until a fix arrives through its routine release cycle. Affected versions, fixed releases and a severity score have not been specified, and no exploitation of this new vulnerability has been reported.

Researcher Andrew Dorman separately reported session-handling flaws surviving in PHP 8.5.12, claiming unauthenticated code execution under specific conditions and session-file truncation under default settings. His findings also demonstrate remote denial of service through a previously reported SimpleXML garbage-collection double-free and an AddressSanitizer-detected use-after-free involving unserialize(); code execution from those memory-safety findings remains unproven on stock builds. Meanwhile, reported exploit attempts against the earlier PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have increased, including attempts to deploy a Mirai variant, without confirmed successful code execution in the cited reporting. Administrators should retain the emergency patches, apply PHP’s upload-progress mitigation and review applications for runtime session-serializer changes.