Just when you thought it was safe to breathe after the PHP2Shell emergency patches, the PHP team is back with another warning.

They've disclosed a new code execution flaw tracked as CVE-2026-115560, and it landed just two days after those massive PHP2Shell fixes. Here's the good news: the project thinks this one is an unlikely risk in the real world. The bad news? It's dropping right as attackers are absolutely hammering the original PHP2Shell flaws with millions of exploit attempts worldwide.

PHP isn't rushing out an emergency patch this time. Instead, they're telling admins to turn off a specific feature until a standard fix lands in the next routine release.

The Narrow Conditions for CVE-2026-115560

Let's be clear about this new bug: it is incredibly niche. It only triggers if your web app is configured in a very specific, and frankly weird, way.

You are only exposed if your application does all of the following: it starts with the session.serialize_handler option set to php_binary or php_serialize, then it dynamically changes that handler back to php at runtime using ini_set(), and it makes that switch right before calling session_start().

On top of that, the session upload progress feature has to be active. But honestly, if your app never changes that serialize handler on the fly, you can leave the feature on and you're completely safe from this path.

PHP says this setup is basically a non-issue in practice. That's why they're treating it as a standard bug fix rather than a crisis, and they'll drop a full advisory alongside the next release.

Comparing the PHP Vulnerabilities

Because this new issue is totally separate from the October 21 patches, the fix for each bug is a little different.

The Surge in PHP2Shell Exploitation Attempts

While you can relax about the new flaw, you definitely can't relax about the old ones. The two critical PHP2Shell bugs patched on October 21 are under heavy fire.

• Amazon just revealed that its honeypots caught exploit attempts against CVE-2026-109618 and CVE-2026-109619 on October 17. That's four days before the flaws were even publicly disclosed. Cloudflare backed that up, reporting that attacks exploded from tens of thousands to millions by early October 22.
• Sophos and Arctic Wolf say attackers are actively trying to drop a Mirai botnet variant using these flaws. But here's a sliver of good news: those attempts are failing. Previdian, Wordfence, and others are seeing a ton of scanning and probing, but zero confirmed code execution. Turns out, building a reliable working exploit for this is a lot harder than the bad guys expected.

How to Secure Your PHP Environment Right Now

Because this new bug is a completely different animal, the October 21 patches won't save you from CVE-2026-115560. Here is what you actually need to do:

• Patch PHP2Shell immediately: Get on PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to kill the actively exploited flaws.
• Disable session upload progress: Set session.upload_progress.enabled=0 to block CVE-2026-115560. This is the exact same setting you should have already flipped for CVE-2026-109619.
• Verify your config: If you turned that setting off on October 21 and left it alone, you don't need to do anything else for this new flaw.
• Watch your logs: Keep an eye out for sudden spikes in weird multipart requests, memory errors, or botnet traffic hitting your server.

FAQ

What is CVE-2026-115560?

It's a new PHP code execution flaw, but it only hits apps that dynamically switch the session serialize handler from php_binary or php_serialize to php before starting a session.

Does the PHP2Shell patch fix CVE-2026-115560?

No. This is a completely separate bug, and the October 21 emergency patches don't touch it.

Has CVE-2026-115560 been exploited in the wild?

Not yet. Every attack we've seen since October 21 is targeting the older PHP2Shell flaws.

Why are the Mirai botnet attacks failing?

Attackers are trying to install a Mirai variant, but researchers at Wordfence, Previdian, and Sophos say a reliable exploit is proving difficult to build. Right now, it's just failed probes.

What is the mitigation for CVE-2026-115560?

Just set session.upload_progress.enabled=0 until the next routine bugfix release. It's the same mitigation PHP told you to use for CVE-2026-109619.

Source: The Hacker News