PHP shares mitigation for new RCE vulnerability with no patch

PHP's security team has disclosed a new remote code execution flaw, CVE-2026-115560, for which no official patch currently exists. The bug only triggers under a specific non-default setup — when session.serialize_handler is configured as php_binary or php_serialize but then switched to php via ini_set() at runtime before session_start() is called, with session upload progress still enabled. Because this configuration is considered rare in real-world deployments, the team plans to ship a full fix and advisory in its next regular release rather than an emergency update. In the meantime, admins are advised to disable the feature by setting session.upload_progress.enabled=0, and those who already applied this setting earlier this week — ahead of the separate PHP2Shell patches for CVE-2026-109618 and CVE-2026-109619 — do not need to take further action, though PHP2Shell is already seeing active, though reportedly unsuccessful so far, exploitation attempts in the wild.