NewsCompaniesFlawsGuides
Get the app
CriticalPartly fixedUpdated

CVE-2026-115560

PHP's session upload-progress feature has an unlikely code execution path when an application changes its session serialisation handler at runtime under the configuration described by PHP.

What to do

If you own a website, ask its host or IT team to confirm the running web server uses PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, or a supplier-confirmed backported fix, and that every PHP worker has been restarted. Also ask them to apply PHP's session.upload_progress.enabled=0 advice for the follow-up issue until its fix arrives. Ordinary website visitors have no PHP update to install.

Affects
PHP web servers and products that bundle PHP
Severity
Critical
Fixed in
PHP 8.2.35 — CVE-2026-109618 and CVE-2026-109619
PHP 8.3.36 — CVE-2026-109618 and CVE-2026-109619
PHP 8.4.27 — CVE-2026-109618 and CVE-2026-109619
PHP 8.5.12 — CVE-2026-109618 and CVE-2026-109619
PHP 8.6.0 RC4 — fixes both original flaws in the development branch; PHP warns against production use
Being used in attacks
Not known to be
Made public
20 Oct 2026

Part of: PHP2Shell flaws exploited: emergency PHP fixes released, but product updates and a follow-up fix remain

PHP2Shell covers two critical flaws in PHP, software that runs websites and online services. They can let an attacker run code without logging in, with the permissions of the web server process. PHP identifies all installations serving web requests as at risk, with Apache mod_php at highest risk; exploitability depends on the server, configuration and application. Emergency releases on 21 October fixed both original flaws across supported stable PHP branches. ITPro reported precautionary shutdowns affecting UK government services and Orange websites, alongside millions of attack attempts reported by Cloudflare. CISA subsequently listed both flaws as exploited. Protection remains partial across products that bundle PHP: Red Hat still describes outstanding updates, and the Dutch NCSC's 2 November inventory records unresolved exposure. A separate session upload-progress issue, CVE-2026-115560, still awaits a regular PHP release as of 3 November; PHP provides a protective setting for its unusual configuration requirements.

The whole incident, its timeline and sources

Fixed in the same update

Sources

  1. PHP October security releases and session upload-progress warningPHP · 23 Oct 2026
  2. RCE via OOM corruptionPHP · 21 Oct 2026
  3. RCE via stale global statePHP · 21 Oct 2026
  4. RHSB-2026-013: PHP request-handling memory corruptionRed Hat · 23 Oct 2026
  5. PHP warns administrators ahead of emergency security updatesBleepingComputer · 20 Oct 2026
  6. PHP attack attempts and precautionary website shutdownsITPro · 22 Oct 2026
  7. CISA urges federal agencies to patch after PHP exploits observedITPro · 28 Oct 2026
  8. PHP2Shell operational guidance and software inventoryNCSC-NL · 2 Nov 2026
Also: CVE-2026-115560 at CVE.org · NVD · Every flaw being used in attacks · Everything live