PHP Security Team Warns of New RCE Vulnerability in Unpatched Systems

The PHP Security Team has shared a mitigation for a new remote code execution (RCE) vulnerability affecting unpatched systems with non-default configurations.

PHP is an open-source web development language used by nearly 70% of all websites on the internet. According to a VirusTotal estimate, more than 5.1 million PHP hosts are exposed online, and approximately 3.8 million have at least one port open to attack.

According to Friday’s advisory, the vulnerability, tracked as CVE-2026-115560, can only be exploited by targeting systems with “unusual combinations of configuration and application code.”

The PHP team explained that applications must set session.serialize_handler to php_binary or php_serialize in the configuration, then switch to php using ini_set() before calling session_start() at runtime. Session upload progress must also remain enabled.

“Applications that do not change their serialization handlers at runtime can leave this feature enabled. Because this configuration is unlikely to occur in the wild, we are addressing it in our normal release cycle and plan to publish a full advisory for CVE-2026-115560 in the next release,” the PHP team said.

PHP recommends disabling session upload progress

PHP developers recommend setting session.upload_progress.enabled=0 until a security patch is available. “If you applied it at that time, leave it alone. No further action is required,” the developers added.

This mitigation should have already been applied on Wednesday, before PHP released patches for two other critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The two flaws are collectively tracked as PHP2Shell.

PHP2Shell vulnerabilities face exploitation attempts

The PHP Security Team patched the PHP2Shell vulnerabilities one day after urging administrators to prepare to install updates as soon as they became available.

Several proof-of-concept (PoC) exploits were published before the patches were released, but the PHP Security Team said none of them worked.

However, several cybersecurity companies, including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack, reported that detailed information about PHP2Shell—including the CVE IDs and mitigation advice provided to some critical infrastructure providers—had leaked online.

Amazon Threat Intelligence researchers also said attackers began targeting PHP2Shell four days before the security patches were released on Wednesday.

“The actual payloads and choices in the anonymization infrastructure are diverse, suggesting that these are multiple attackers. Technical analysis is ongoing, but it is unclear whether any of these attempts were successful on real-world systems,” said CJ Moses, Chief Information Security Officer at AWS.

Moses added that “PHP2Shell is currently the subject of widespread exploitation attempts,” although it remains unclear how many, if any, attacks were successful.

The Dataminr Threat Research and Cyber Engineering (TRACE) Team also said that activity observed since the vulnerability was disclosed remained limited to scanning, fingerprinting, and non-functional exploits, with no known compromises.

However, the team warned that “it is only a matter of time before a working PoC or exploit activity is successful.”

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report