PHP disclosed a new RCE vulnerability, but exploitation requires a rare and specific configuration setup
Unlike php2shell, the flaw will be fixed in the next regular release rather than an emergency patch
Researchers say php2shell attacks remain limited so far, though widespread patching is still urgently needed
The PHP Security Team has discovered yet another remote code execution (RCE) vulnerability in the now-notorious programming code, but since the issue is not that easy to abuse, it won’t receive an out-of-bounds fix. The organization recently published a new security advisory warning users about a session upload progress bug in PHP, tracked as CVE-2026-115560. In the advisory, the organization said the bug can only be abused “under an unusual combination of configuration and application code”. “An application must set session. serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled,” the advisory reads. So, unless your setup has these exact settings, you’re not at risk. The PHP Security Team also suggests users set session. upload_progress. enabled=0 until the next regular bugfix release, to fully protect from this RCE vector, which they explained as “unlikely”. They also said this setting was listed as a mitigation for CVE-2026-109619, so users who applied it then should just keep it and do nothing else. PHP2Shell
CVE-2026-109619 is one of two critical-severity RCE vulnerabilities recently discovered and dubbed “ php2shell ”, the discovery of which caused widespread panic, since the implications were monumental, to put it mildly. PHP is an extremely popular programming language used to build websites and web apps. Some analysts claim that roughly 70% of all websites on the internet are running PHP, including banking, education, healthcare, and government sites. It was revealed that the PHP Security Team was working on a fix for php2shell and that a handful of security organizations knew, or were involved in the work. The bugs allowed threat actors to take full control over the websites…