PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has disclosed a fresh remote code execution issue, tracked as CVE-2026-115560, just two days after rushing out fixes for the critical PHP2Shell bugs. Unlike that emergency release, this new flaw only affects a narrow and uncommon configuration, so PHP is not issuing an out-of-cycle patch and instead advises disabling the session upload progress feature by setting session.upload_progress.enabled=0 until the next scheduled bugfix release. The bug can be triggered only when an application sets session.serialize_handler to php_binary or php_serialize, then switches it to php via ini_set() before calling session_start(), with session upload progress still enabled. This is separate from the earlier critical flaws CVE-2026-109618 and CVE-2026-109619, already patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which remain under active exploitation—Cloudflare reported attempts surging from tens of thousands to millions within a day of disclosure, and Sophos and Arctic Wolf observed failed attempts to deploy a Mirai botnet variant through them.