Threat Pulse 62High
PHP warns of third unpatched issue (CVE-2026-115560); disable session upload progress
Severity 4MitigatedconfirmedWeb servers and gateways

Two days after PHP2Shell, PHP disclosed a related issue triggered only when session.serialize_handler is php_binary or php_serialize, the app switches it to php at runtime before session_start(), and upload progress is enabled. PHP rates exploitation unlikely and will fix it in the next routine release; set session.upload_progress.enabled=0 in the meantime.

What to do: Set session.upload_progress.enabled=0 until the next PHP bugfix release. php.net informational advisory Oct 23: no fix yet, full advisory with the next regular release. Set session.upload_progress.enabled=0 in php.ini or the FPM pool, not with ini_set(). Only sites that switch session.serialize_handler to php at runtime are exposed. MyCERT (Oct 24 14:10 UTC) and CERT-AgID (Oct 24 19:35 UTC) issue…

· 13 days ago · PHP servers with the specific session configuration · The Hacker News
SourcesThe Hacker Newsphp.netcert-agid.gov.it
On X
@BleepinComputerverifiedOct 23, 15:38 UTC

PHP shares mitigation for new RCE vulnerability with no patch

Open on X
@mycertverifiedOct 24, 14:10 UTC

MA-1490.102026: MyCERT Alert - New Critical PHP Vulnerability (CVE-2026-115560) and Analysis on PHP2Shell Active Exploitation Script #php2shell

Open on X
@AgidCertverifiedOct 24, 19:35 UTC

Vulnerabilità #RCE su #PHP CVE-2026-115560 ➡️PHP Security Team ritiene che lo sfruttamento richieda una combinazione di condizioni poco probabile. 💡Disponibile workaround per la mitigazione. ℹ️ Ulteriori dettagli 👇 🔗

Open on X
Why this score

Potentially every PHP server (impact 4), narrow preconditions and no exploitation (exploitability 0), general (criticality 0); mitigation available so no unresolved bonus.

Back to the board

Updated Nov 5, 01:44 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.