PHP has disclosed a second unpatched vulnerability that could allow attackers to execute code on web servers, just two days after shipping emergency patches for critical PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, affects only web applications configured in an unusual way, and the project considers it an unlikely risk. Rather than issuing an emergency patch, PHP is recommending that administrators disable a feature called session upload progress until a fix arrives in the next routine release.
The vulnerability can only be exploited under a narrow set of conditions, according to PHP's informational advisory published October 23. An application must set the session.serialize_handler option to php_binary or php_serialize in its configuration, then switch that option to php while running by calling ini_set(), and make that switch before calling session_start(). Session upload progress must also remain enabled. Applications that never modify the serialize handler while running can keep the feature active and aren't vulnerable through this avenue. PHP hasn't stated which versions are affected, which releases will contain the fix, or assigned a severity score, and the organization hasn't said whether the new issue shares a root cause with CVE-2026-109619.
The recommended mitigation is a single configuration change: set session.upload_progress.enabled=0 until the next routine bugfix release. PHP notes this is the same setting it already listed as a mitigation in the October 21 advisory for CVE-2026-109619, meaning anyone who applied it then and left it in place needs to take no further action for the new issue. Session upload progress is enabled by default and allows an application to track file upload progress. Because the vulnerable setup is uncommon, PHP is handling the fix as part of its regular release cycle rather than as an emergency, and it will publish a full advisory for CVE-2026-115560 with the next release.
The disclosure comes as attacks targeting the two earlier PHP2Shell flaws have surged. Amazon reported its honeypots logged an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days before the flaws were disclosed, and Cloudflare said attempts rose from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22. Attackers have tried to use the flaws to install a Mirai botnet variant, according to Sophos and Arctic Wolf, though those attempts have so far failed. Previdian, Wordfence and others report scanning and probing but no confirmed code execution, and researchers say a reliable exploit is proving harder to build than expected. That activity targets the two flaws patched on October 21—CVE-2026-109618 and CVE-2026-109619, which were fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35—not CVE-2026-115560, which has not been reported under attack. No exploitation of CVE-2026-115560 has been reported. The decision to delay a patch reflects confidence that the vulnerable configuration is rare enough to justify waiting for the standard release schedule, rather than rushing out a third emergency fix in less than a week. Organizations running custom PHP applications should audit their session handler configurations to determine exposure, particularly if they dynamically change serialization settings during runtime.