PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

What happened

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.

The new issue, assigned CVE-2026-115560 , affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.

Instead, it recommends turning off a feature called session upload progress until a fix is available in the next routine release.

What changed

The warning came in a short informational advisory published on October 23.

Those were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The new issue is separate and is not fixed by those releases.

Who is affected

It follows the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619 , which let an attacker without an account run code on a server.

PHP has not stated which versions are affected, which releases will contain the fix, or a severity score.

Why it matters

PHP says the problem can occur when a web application does all of the following: sets the session.serialize_handler option to php_binary or php_serialize in its configuration, then changes that option to php while running by calling ini_set(), and makes that change before it calls session_start().

An application that never changes the serialize handler while running can leave the feature on and is not exposed through this path.

Technical details

This is the same setting it already listed as a mitigation in the October 21 advisory for CVE-2026-109619.

Session upload progress is turned on by default and lets an application track the progress of a file upload.

Because the setup is uncommon, PHP is handling the fix as part of its regular release cycle rather than as an emergency, and it will publish a full advisory for CVE-2026-115560 with the next release.

Response

PHP recommends setting session.upload_progress.enabled=0 until the next routine bugfix release.

That activity targets the two flaws patched on October 21, not CVE-2026-115560, which has not been reported under attack.

What security teams should do

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.

The shortcomings are present in every PHP release from the 7.x and 8.x series, and pose a risk to every reachable PHP endpoint on an affected server, including static forms, login routes, and health checks.

What remains unknown

It also has not said whether the new issue shares a root cause with CVE-2026-109619.

While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," said AWS chief information security officer CJ Moses .

Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems. now being broadly exploited in the wild, defenders should not assume the public disclosure date is the earliest date of exploitation. observed activity since vulnerability disclosure remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises, it remains only a matter of time for working POCs or successful exploitation activity to emerge." PHP (Hypertext Preprocessor) is an open-source web development language that powers up to 80% of all websites on the Internet, including those using popular Content Management Systems (CMS) like WordPress, Drupal, and Joomla.

Attribution

The Hacker News: PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.

The Hacker News: Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.

The Hacker News: This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21.

The Hacker News: Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium , as it emerges that weaponizing the flaws may be harder than previously thought.

What to watch next

Watch for additional victim details, indicators of compromise and follow-on exploitation reports.

Watch for revised vendor guidance, fixed versions and mitigation updates.