As the PHP2Shell security crisis unfolds, researchers have uncovered a third remote code execution flaw designated as CVE-2026-115560, but the PHP Foundation has confirmed it will not receive an emergency patch, The Register reported. Instead, the vulnerability will be addressed in the next scheduled PHP software release.
The Technical Requirements of CVE-2026-115560
The newly identified flaw requires an extraordinarily specific chain of conditions to execute successfully. An application must configure session.serialize_handler to either php_binary or php_serialize, and then switch it dynamically at runtime using ini_set() prior to invoking session_start(). Furthermore, the session upload progress feature must remain active for the attack vector to function.
“requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP,” Elizabeth Barron, executive director of the PHP Foundation, told The Register.
Because this exact setup rarely appears in real-world production environments, the core maintainers decided against pushing an immediate out-of-band security advisory or emergency patch. The PHP Security Team published an informational advisory instead, detailing the risk parameters.
Configuration Adjustment Protects Systems from Remote Code Execution
Developers seeking proactive defense before the official bugfix release can implement a straightforward configuration adjustment. The advisory explicitly recommends that users set session.upload_progress.enabled=0 to fully protect systems from this specific remote code execution vector.
This third discovery trails closely behind the severe PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Those two memory-safety flaws affect PHP, an open-source programming language powering roughly 70 percent of websites utilizing a known server-side language. The PHP Foundation disclosed and patched both initial bugs.
Industry Response to Mass Exploitation Attempts
Despite widespread reports of mass scanning and exploitation attempts alongside circulating proof-of-concept code, security telemetry indicates no confirmed successful compromises stemming from PHP2Shell.
“We have no evidence of successful exploitation of the two vulnerabilities from Wednesday prior to disclosure, and we currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions,” Elizabeth Barron noted to The Register, confirming close coordination with OpenAI, Wiz, and Calif.
Independent security researchers and enterprise firms have heavily monitored the situation. Mandiant Chief Technology Officer Charles Carmakal stated on LinkedIn that while widespread successful exploitation remains unconfirmed, the threat is entirely viable. Carmakal added that while many circulating exploit proofs-of-concept are “vibe-coded” and non-functional, validated exploits capable of achieving remote code execution against default deployments of mod_php—though not PHP-FPM—have been successfully tested.
