CVE-2026-115560
AI description
CVE-2026-115560 is a remote code execution (RCE) vulnerability in PHP's session upload progress feature, which was disclosed by the PHP project in October 2026. The vulnerability stems from the inconsistent handling of session data when an application changes its serialization formats during request processing. It specifically affects environments where the `session.serialize_handler` is initially configured as `php_binary` or `php_serialize`, but is subsequently changed to `php` at runtime using `ini_set()` before `session_start()` is called, while the session upload progress feature remains active. Because this vulnerability requires a highly specific and uncommon combination of configuration settings and application code, the PHP security team has characterized it as an unlikely vector in practice. As a result, the issue is being addressed through PHP's routine release cycle rather than an emergency patch. Until a formal update is released, the recommended mitigation is to disable the session upload progress feature by setting `session.upload_progress.enabled = 0` in the PHP configuration.
- Description
- -
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
16
WAF rules updated to block PHP RCE attacks discovered during the recent CTF challenge. Your apps are now hardened against CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560. https://t.co/hsXzSv4sWX
@CFchangelog
31 Oct 2026
11243 Impressions
25 Retweets
161 Likes
38 Bookmarks
6 Replies
2 Quotes
Imunify360 released WAF rules 8.90 and 8.91. 8.90 is the one to note: • PHP object injection (CVE-2026-115560): new rule WPT-4087 blocks it via the session upload progress field. Same attack path as php2shell, now with its own CVE. • Stored XSS: WordPress core before 7.0.3
@georgetasioulis
27 Oct 2026
138 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Our PHP security article has been updated. 🔓CISA has confirmed active exploitation of CVE-2026-109618/109619. 🔐We also reviewed the newly disclosed CVE-2026-115560 and confirmed EasyDCIM is not affected. https://t.co/Rg2cT7jb3r
@EasyDCIM
27 Oct 2026
58 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
France's CERT-FR updated its PHP alert (CERTFR-2026-ALE-014) on Oct 26. It now observes exploitation attempts against CVE-2026-109618 and CVE-2026-109619 targeting specific PHP deployments, and it has added CVE-2026-115560, which PHP says needs an uncommon setup and will be fixed
@InfraWatchHQ
26 Oct 2026
149 Impressions
0 Retweets
1 Like
0 Bookmarks
1 Reply
0 Quotes
🔒 #CyberSecurity CVE-2026-115560: PHP Critical RCE Mitigation and Detection Guide "The PHP Group has published urgent mitigation advice for CVE-2026-115560, a critical code execution…" 🔗 https://t.co/m0WftctT1l #CyberSecurity #ThreatIntel #critical #zeroday #cve
@SecurityAr58409
26 Oct 2026
60 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨PHP2Shell 緊急修補才釋出兩天，PHP 基金會又公告一個尚未修補的遠端程式碼執行漏洞。 PHP 基金會 10 月 23 日揭露 CVE-2026-115560。觸發條件相當罕見：應用程式必須先在設定檔把 session.serialize_handler 設為 php_binary
@lfcba8178
26 Oct 2026
103 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
PHP2Shell: checklist de 2 minutos pra quem ainda tem PHP em produção. 1. php -v Abaixo de 8.5.12, 8.4.27, 8.3.36 ou 8.2.35, está vulnerável. A 8.1 ou anterior não recebe mais patch. 2. php -i | grep upload_progress Tem que estar Off. A CVE-2026-115560 ainda não tem patch,
@tiagohintz
25 Oct 2026
101 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
PHP powers ~70% of sites with a known backend language. PHP2Shell: CVE-2026-109618 + CVE-2026-109619. Two days later: CVE-2026-115560. “PHP is dead” but keeping server admins very alive 😭 check your versions and configs. @php_net https://t.co/A9ciBRlNzX
@Jatin__Saini
25 Oct 2026
169 Impressions
0 Retweets
2 Likes
0 Bookmarks
3 Replies
0 Quotes
This PHP vulnerability taught owners one hard lesson: "Patched" is a status that expires. PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2) hit PHP itself — the layer below WordPress, plugins, and frameworks. A third flaw, CVE-2026-115560, affects even fully patched
@PHPSiteAudit
24 Oct 2026
24 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE ALERT: PHP2Shell. CVE-2026-109618/-109619 (unauth RCE, CVSS 4.0 9.2) are fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. A related bug, CVE-2026-115560, is NOT fixed yet: set session.upload_progress.enabled=0 in php.ini (restart PHP) until the next release. #PHP #infosec htt
@DazedProgrammer
24 Oct 2026
102 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
🚨 แจ้งเตือน! พบช่องโหว่ใหม่ CVE-2026-115560 ใน PHP เสี่ยงถูกรันคำสั่งบนเว็บเซิร์ฟเวอร์ ศูนย์ประสานการรักษาความ
@ThaiCERTByNCSA
24 Oct 2026
108 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Cloudflare ha actualizado su aviso técnico con una limitación importante de sus reglas WAF frente a la nueva CVE-2026-115560 de PHP2Shell. La regla "PHP Remote Code Execution Attack #6", desarrollada para CVE-2026-109618 y CVE-2026-109619, también protege contra los intentos
@3kept1c
23 Oct 2026
101 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
php2shell poc 3 CVE's • CVE-2026-109618 • CVE-2026-109619 • CVE-2026-115560 Auto-LFI Discovery SAPI Profiling (FPM, Apache, FrankenPHP) OOM Fuzzing Calibration Worker Pinning & Keep-Alive Pools 🔗 GitHub: https://t.co/dPAmb6bzuY #CyberSecurity #SecOps #PHP2Shell #
@murrezsec
23 Oct 2026
210 Impressions
1 Retweet
3 Likes
0 Bookmarks
0 Replies
0 Quotes