PHP Shares Mitigation for Unpatched RCE Vulnerability

The PHP security team has shared a mitigation for a remote code execution (RCE) vulnerability that has no patch yet and affects systems with an unusual combination of configuration and application code.

Tracked as CVE-2026-115560, the flaw can be exploited only if an application sets session.serialize_handler to php_binary or php_serialize, switches it to php at runtime with ini_set() before calling session_start(), and leaves session upload progress enabled. The team said applications that do not change the serialization handler at runtime can leave the feature enabled. It plans to publish a full advisory with the next release.

Until a security patch is available, PHP developers recommend setting session.upload_progress.enabled=0. The team said systems where this mitigation was already applied on Wednesday need no further action.

The advice follows emergency patches for two other critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The source reports that security companies detected unsuccessful exploitation attempts before public disclosure. Amazon Threat Intelligence said attackers began targeting the PHP2Shell flaws four days before patches were released, while Dataminr's TRACE team reported scanning and non-working exploits, with no known compromises. The source says it is unclear whether any attempts succeeded.