PHP Security Team Warns of New Vulnerability, Urges Precautionary Measures
In a recent advisory issued on October 23, the maintainers of PHP, a widely utilized programming language, have alerted users to a new remote code execution (RCE) vulnerability identified as CVE-2026-115560. While the PHP security team emphasized that the potential risk is low and likely affects a small fraction of the userbase, they have nonetheless indicated that vigilance and preventive measures are warranted.
The advisory outlined that a patch for this new vulnerability will not be made available until the next release of the programming language. The specific conditions necessary for this vulnerability to be exploited are deemed uncommon in typical operational environments. According to the PHP security team, the issue arises only under a unique combination of configuration settings and application code.
“An application must specifically configure its session.serialize_handler to either php_binary or php_serialize. After this, it must switch the handler to ‘php’ during runtime using the ini_set() function prior to invoking session_start().” The advisory further noted the requirement for session upload progress to be activated for exploitation to occur. Importantly, applications that maintain a steady serialize handler without runtime changes can safely keep the upload progress feature enabled.
This news comes on the heels of an ongoing challenge for system administrators who have recently faced significant outages. Many were scrambling to address two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—identified last week and collectively named “P2PShell.” These maximum severity flaws necessitated immediate attention from administrators who found themselves caught off-guard by the urgent need to patch vulnerable systems.
Mike Lyborg, the Chief Information Security Officer at Swimlane, weighed in on the situation, suggesting that the emergence of the new flaw necessitates a calculated and precise response. He pointed out the exhaustion that followed the disruptions experienced by many organizations in the wake of PHP2Shell last week. “Keeping services operational amidst successive warnings demands coordinated efforts that can often falter as fatigue sets in,” he remarked. Lyborg highlighted the potential for complications when transitioning responsibilities between teams assessing risks and those with the authority to implement changes in live services.
The urgency of the situation was exacerbated when details regarding the vulnerabilities were inadvertently disclosed just a day prior to the promised release of patches. In a concerning development, Amazon Web Services revealed that an unidentified threat actor had attempted to exploit these vulnerabilities four days before they were officially disclosed. This raises alarming questions about how such critical information fell into the hands of malicious actors, suggesting heightened risks for PHP users.
PHP’s prevalence is notable, with the language powering approximately 70% of all websites globally, including widely used content management systems like WordPress, Drupal, Joomla, and Magento. This extensive usage means that the effort to patch P2PShell is not just an isolated concern but a major global endeavor impacting countless websites and digital services.
In light of the recent developments, the PHP security team has recommended that system administrators take certain precautionary measures. They have advised that users disable session upload progress by setting the parameter session.upload_progress.enabled to 0 until the next scheduled bug-fix release. This step is presented as a direct method to mitigate any potential exploitation via the newly identified RCE vector. “For those who have already implemented this recommendation, continued application is advised, and no further action is needed,” the advisory reassured.
The overlapping vulnerabilities and the challenges posed by the latest findings illustrate an ongoing battle within the digital landscape. Organizations that rely on PHP must remain vigilant and prepared to act swiftly in response to security advisories, balancing operational continuity with the imperative of safeguarding their systems against evolving threats. As the PHP security team works diligently towards a resolution, the community watches closely, highlighting the intricate relationship between technological reliance and cybersecurity vigilance in today’s interconnected world.