The PHP security team has posted a workaround for a new remote-code-execution bug, tracked as CVE-2026-115560, that has no patch yet, BleepingComputer reported Friday¹.

The outlet said the flaw can be used only against systems with a non-default mix of settings and application code¹. PHP described the required path as setting session.serialize_handler to php_binary or php_serialize, then switching it to php at runtime with ini_set() before session_start(), with session upload progress still enabled¹.

"Applications that never change the serialize handler at runtime can keep the feature enabled," the PHP team said, according to BleepingComputer¹. The project said it will handle a full advisory in the regular release cycle because the setup is unlikely in practice¹.

Until a patch ships, PHP suggested setting session.upload_progress.enabled=0¹. The same setting was already listed as a mitigation for earlier critical bugs patched this week, and BleepingComputer said operators who applied it then need no extra step¹.

PHP is used on a large share of websites; BleepingComputer cited VirusTotal estimates of more than 5.1 million PHP hosts exposed online¹. Those figures describe internet-facing hosts, not how many match this configuration¹.

The report tied the notice to this week's emergency PHP2Shell patches for CVE-2026-109618 and CVE-2026-109619¹. BleepingComputer said unsuccessful exploitation attempts against those earlier flaws were seen after details leaked, according to Patchstack and the PHP Foundation¹. It did not report in-the-wild attacks on CVE-2026-115560¹.

Sources

1. BleepingComputerPHP shares mitigation for new RCE vulnerability with no patchOct 23, 11:38 AM

Read the original at BleepingComputer ↗