The PHP project on Thursday warned of a separate remote-code-execution path that is not covered by this week's emergency PHP2Shell patches, and said operators should disable session upload progress until a routine fix ships, The Hacker News reported¹.

The informational advisory assigned the issue CVE-2026-115560 and said PHP will not issue an emergency release¹. PHP described the setup as uncommon: an application that sets session.serialize_handler to php_binary or php_serialize, then switches it to php with ini_set() before session_start(), while session upload progress remains on¹.

The recommended setting is session.upload_progress.enabled=0, the same mitigation PHP listed on Oct. 21 for CVE-2026-109619¹. Operators who already applied that setting need no extra step for the new issue, according to the report¹. The Oct. 21 emergency builds — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — fixed CVE-2026-109618 and CVE-2026-109619 and do not close CVE-2026-115560¹.

PHP has not stated which versions are affected, which releases will carry the fix, or a severity score, and has not said whether the new issue shares a root cause with CVE-2026-109619¹. No exploitation of CVE-2026-115560 has been reported¹.

The other outlets in this cluster focused on the earlier PHP2Shell flaws and the rush to patch, not Thursday's advisory^2,3,4. NPR described governments and agencies urging updates after researchers disclosed those flaws and said exploit attempts rose afterward². The Guardian described industry executives warning that AI-assisted discovery could outpace patching³.

A Bloomberg Opinion column carried by CNA treated the PHP2Shell episode as a defensive success: flaws found in August, a public patch on Oct. 21 after a leak advanced the timeline, and limited confirmed damage so far⁴. That column does not address CVE-2026-115560⁴.

The Hacker News said scanning and botnet attempts reported since Oct. 21 have targeted the two patched PHP2Shell flaws, with researchers still describing a reliable exploit as hard to build¹. What remains unknown is when PHP will ship the full CVE-2026-115560 advisory and how widely the unusual configuration exists in production¹.

Sources

1. The Hacker NewsPHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell PatchesOct 23, 7:25 AM
2. NPRHacking attempts rise after flaws found in program affecting 70 percent of websitesOct 23, 5:48 AM
3. The Guardian‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hackingOct 23, 2:48 PM
4. CNACommentary: PHP vulnerabilities - why the good guys have notched a victory in AI-cybersecurity ageOct 23, 6:00 PM

Read the original at The Hacker News ↗