KISA issues emergency mitigation for unpatched PHP RCE flaw
The PHP Group has not named affected or fixed versions, and KISA says a workaround used for an earlier flaw also covers CVE-2026-115560.
The Korea Internet & Security Agency (KISA) has issued emergency temporary mitigation guidance after The PHP Group disclosed a new remote code execution vulnerability in PHP tracked as CVE-2026-115560, according to bloter.net. No official patch is available yet.
The flaw lies in how PHP handles sessions and could let an attacker run arbitrary commands or programs on a server. KISA advised administrators to set session.upload_progress.enabled to 0 in php.ini or the PHP-FPM configuration, then restart PHP worker processes.
According to the advisory, only servers that both change how session data is stored at runtime and enable the file upload progress feature are affected.
The PHP Group has not disclosed which versions are affected or fixed, and plans to ship an official patch in its next regular update. On 23 October 2026, it announced a temporary response plan for the vulnerability.
The same workaround was already part of the mitigation for CVE-2026-109619, a separate flaw disclosed on 21 October 2026, so servers that disabled the feature then need no further action.
Quick answers
What is CVE-2026-115560?
It is a remote code execution vulnerability in PHP's handling of sessions that could allow an attacker to run arbitrary commands on a server.
Is there a patch for the PHP flaw?
Not yet. The PHP Group plans an official patch in its next regular update and has not disclosed affected or fixed versions.
Which servers are affected?
Only servers that both change how session data is stored at runtime and enable the file upload progress feature.