PHP Flags Another RCE Bug: One Setting to Change

Two days after PHP pushed out emergency patches for the PHP2Shell bugs, the project has flagged one more way an attacker could run code on a server. The good news is that this one only bites a small number of oddly configured apps, and the fix is a single setting that a lot of admins should already have turned off this week.

What happened

On 23 October 2026 the PHP team posted an informational advisory on php.net about a new remote code execution issue, CVE-2026-115560. It's tied to a feature called session upload progress, which lets an app track how far along a file upload is. That feature is on by default.

According to PHP, the bug needs a specific combination to be reachable. The app has to set session.serialize_handler to php_binary or php_serialize in its config, then switch it back to php at runtime with ini_set() before it calls session_start(). Session upload progress also has to be enabled. If your code never changes the serialize handler while it runs, PHP says you can leave the feature alone.

This is a separate problem from the two critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Those releases don't fix the new one. PHP says it will ship the fix in its next regular bugfix release, along with a full advisory, rather than rushing out another emergency build. The Hacker News flagged it on X shortly after the notice went up.

Why it matters

PHP still runs a huge share of the web, from WordPress sites to custom shop backends, so any code execution bug gets attention fast. The odd part here is the timing. Admins who were already scrambling with the 21 October patches now have a second CVE that those patches don't cover.

Honestly, though, the risk for most people looks low. PHP itself calls the setup unlikely in practice, it hasn't published a severity score or an affected version list yet, and there are no reports of anyone exploiting this new bug. The heavy scanning and exploit attempts seen this week, as reported by The Hacker News, are aimed at the two older PHP2Shell flaws.

What to do

• First, make sure you're actually on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro's patched build). That matters far more right now than this new bug.
• Set session.upload_progress.enabled=0 in php.ini or your FPM pool config, then restart every PHP worker. PHP's earlier advice says not to rely on ini_set() or a .user.ini file for this.
• If you already made that change for CVE-2026-109619 on 21 October, leave it in place. You don't need to do anything else.
• If your app uses upload progress bars, check that uploads still work after the change, and plan to turn it back on once the next PHP release is out.

If you run a small home server, it's also a good moment to check what's exposed to the internet at all. I covered private remote access in my Tailscale vs WireGuard comparison, and earlier today I wrote about another certificate security problem in eMudhra's weak keys.

Sources: PHP news and security advisories, PHP on Mastodon, with reporting from The Hacker News.