Trusence Every claim has a source
Last updated 23 October 2026 Search Türkçe
Security

PHP publishes interim mitigation for unpatched remote code execution flaw

Server operators running affected configurations must disable one setting now, while attackers have so far mostly probed the PHP2Shell flaws without confirmed compromises.

23 October 2026 1 min read

The PHP security team has published interim mitigation for a newly disclosed remote code execution flaw, CVE-2026-115560, for which no patch exists yet. It only affects servers combining a specific session serialization setting with runtime changes to that setting, a combination the team considers unlikely in practice. Until a fix ships, administrators are told to disable session.upload_progress.enabled, and the full advisory is promised with the next release. Separately, the two PHP2Shell flaws were patched earlier in the week, and Cloudflare, watchTowr, Previdian, Hadrian and Patchstack reported blocked exploitation attempts before disclosure, while AWS observed attempts starting four days before patches and says it is unclear whether any would have worked. Dataminr has seen only scanning and non-working exploits so far, though it expects working proofs of concept to emerge.

Why it matters

The flaw only bites servers that pair a particular session setting with runtime changes to it, a combination the PHP team considers unlikely, so most PHP sites are not exposed by this one. For operators who do run that combination, the workaround is the only protection until a release ships and the full advisory is published. The wider picture is that attackers were already probing the earlier PHP2Shell flaws days before patches appeared, but security firms and AWS report only blocked or unclear attempts so far, so the immediate risk is a waiting period rather than active damage.

Series Critical PHP flaws

  1. 23 Oct PHP publishes interim mitigation for unpatched remote code execution flaw
  2. 23 Oct IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
  3. 23 Oct Early leak of two critical PHP flaws forces disclosure to move up a day
  4. 22 Oct PHP flaws prompt urgent patching across the web as attack attempts climb
  5. 22 Oct Attacks on PHP2Shell flaws began four days before patches shipped, Amazon says
  6. 22 Oct PHP Flaws Prompt Precautionary Site Takedowns Worldwide
The whole series · 10 stories →

Sources · 1

Checked against its sources before publishing · 23 October at 19:12