PHP issues mitigation for unpatched CVE-2026-115560 RCE flaw

The PHP security team has published mitigation measures for an unpatched remote code execution vulnerability tracked as CVE-2026-115560, according to BleepingComputer.

The flaw is only exploitable on systems where session.serialize_handler is set to php_binary or php_serialize and then switched to php at runtime with ini_set() before session_start(), with session upload progress enabled. Until a patch is available, the PHP developers recommend setting session.upload_progress.enabled=0. The full advisory will be published with the next release.

Separately, the team patched the two PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, on Wednesday. Amazon Threat Intelligence researchers said attackers began targeting the PHP2Shell flaws four days before the patches were released.

Multiple cybersecurity companies detected unsuccessful exploitation attempts before public disclosure. Dataminr's TRACE team reported activity limited to scanning, fingerprinting and non-working exploits, with no known compromises.

PHP is an open-source web development language used by nearly 70% of all websites on the Internet. According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks.