PHP Warns of Another Unpatched Remote Code Execution Vulnerability: What Website Owners Need to Know

PHP has issued a new security warning about CVE-2026-115560, a potential remote code execution (RCE) vulnerability disclosed on October 23, 2026. The announcement comes just two days after emergency PHP updates addressed two critical PHP2Shell vulnerabilities.

Although the newly reported issue affects only applications using a specific and uncommon session configuration, it is another reminder that keeping the PHP runtime secure is essential for every PHP-powered website, including eCommerce platforms and enterprise applications.

What Is CVE-2026-115560?

CVE-2026-115560 involves PHP session handling and the session upload progress feature. Under a particular configuration, an application may create a path that could allow an attacker to execute code on the server.

According to the published report, the vulnerable configuration requires several conditions to occur together:

• The application configures session.serialize_handler as php_binary or php_serialize.
• It changes the setting to php at runtime using ini_set().
• The change happens before session_start() is called.
• Session upload progress remains enabled.

PHP considers this configuration uncommon and is addressing the issue through its regular release cycle rather than an emergency patch.

At the time of publication, the PHP project had not confirmed the affected versions, the fixed release versions, or a severity score for this vulnerability.

Is This Related to the PHP2Shell Vulnerabilities?

CVE-2026-115560 is separate from the two critical PHP2Shell vulnerabilities disclosed earlier in October.

The PHP2Shell issues are:

• CVE-2026-109618
• CVE-2026-109619

Emergency fixes for those vulnerabilities were released in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

However, installing those updates does not resolve CVE-2026-115560. The PHP project has recommended a configuration-based mitigation while a fix is prepared for a routine release.

It is also important to distinguish the reported activity: exploitation attempts have been reported for the earlier PHP2Shell vulnerabilities, but no exploitation of CVE-2026-115560 had been reported in the source article.

Recommended Mitigation: Disable Session Upload Progress

PHP recommends disabling session upload progress until a fix becomes available.

Set the following directive in the appropriate PHP configuration:

session.upload_progress.enabled = 0

Depending on your environment, this setting may be applied through the relevant PHP configuration file or another supported configuration mechanism.

After changing the configuration:

1. Verify that the directive is effective for the PHP runtime handling web requests.
2. Restart or reload the relevant PHP services where required.
3. Confirm that the setting persists across deployments and container restarts.
4. Test file uploads and other session-dependent application functionality.
5. Monitor PHP and web server logs for unexpected errors.

If this mitigation is already enabled and remains effective, the report indicates that no additional action is required specifically for this newly reported issue.

Important: This is a temporary mitigation, not a replacement for installing the appropriate security fix when it becomes available.

What Should Adobe Commerce and Magento Store Owners Do?

Adobe Commerce and Magento rely on PHP, so administrators should assess their underlying PHP runtime and session configuration rather than assuming that an application-level update alone resolves the issue.

Recommended actions include:

1. Review PHP Session Configuration

Inspect the effective PHP configuration for:

session.upload_progress.enabled
session.serialize_handler

Check both the command-line configuration and the configuration used by PHP-FPM or the web-serving runtime. These can differ.

2. Verify Custom Code and Extensions

Review custom modules, third-party extensions, and integrations for runtime changes to session.serialize_handler, particularly calls to ini_set() that occur before session_start().

The reported vulnerability requires a specific combination of settings, so avoid assuming that every PHP or Magento installation is affected.

3. Assess Your Hosting Environment

For Adobe Commerce Cloud and other managed environments, confirm which PHP runtime is actually deployed and which configuration options can be changed through supported mechanisms.

For self-managed servers, containers, and PHP-FPM deployments, ensure that the mitigation is applied to the correct runtime and persists after a restart or deployment.

4. Follow Official Security Advisories

Monitor the PHP project’s official advisories and release notes for the complete technical details, confirmed affected versions, and the release containing the fix.

Adobe Commerce merchants should also review relevant Adobe security advisories and compatibility requirements before changing PHP versions.

5. Maintain a Security Response Process

Keep an inventory of PHP versions across production, staging, background workers, and scheduled jobs. Test security updates in a controlled environment, prioritize internet-facing systems, and investigate suspicious activity where appropriate.

Final Thoughts

CVE-2026-115560 highlights the importance of monitoring security issues at the runtime level, not just within application code and extensions.

For website owners and eCommerce teams, the recommended immediate step is to review PHP session configuration and disable session upload progress where appropriate. Continue monitoring official advisories and apply the relevant security fix once it becomes available.

A proactive approach to runtime security helps reduce exposure and keeps business-critical applications more resilient against emerging threats.

Source: The Hacker News — PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches.

Read the original report: https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

Disclaimer: This article summarizes publicly reported security information as of October 23, 2026. Confirm the applicable configuration and remediation guidance against official PHP and platform vendor advisories before making production changes.