PHP RCE vulnerability CVE-2026-115560: No emergency patch

What are the specific requirements to exploit CVE-2026-115560?

Exploiting the CVE-2026-115560 vulnerability is not a straightforward process for most attackers, as it requires a very specific and unusual application configuration. According to the PHP Security Team's advisory, the flaw resides within the session upload progress mechanism and can only be triggered under a precise set of circumstances involving both server configuration and runtime code changes.

To be at risk, an application must meet several strict criteria simultaneously. First, the server must have the session.serialize_handler set to either php_binary or php_serialize in its initial configuration. Second, the application must explicitly change this handler to php at runtime using the ini_set() function before the session_start() command is executed. Finally, the session upload progress feature must remain enabled.

Because most modern applications do not dynamically switch their serialization handlers in this manner, the PHP Security Team has characterized the likelihood of this RCE being successfully exploited in the wild as "unlikely." If an application maintains a consistent serialization handler throughout its lifecycle, the specific vector required for this bug remains closed.

How should administrators mitigate the risk of this RCE?

While an emergency patch is not being issued, the PHP Security Team has provided clear guidance for administrators to secure their environments until the next scheduled bugfix release. The primary recommendation is to disable the session upload progress feature entirely to close the potential attack vector.

Administrators can implement this mitigation by setting session.upload_progress.enabled=0 in their PHP configuration. This action effectively neutralizes the bug without requiring an immediate update to the core software. For organizations that have already applied similar settings as a mitigation for previous vulnerabilities, such as CVE-2026-109619, the advice is to maintain those existing configurations.

Summary of recommended configuration changes

To ensure maximum protection, administrators should review their php.ini files or runtime configurations. The following table outlines the current status and the recommended action:

Why was the php2shell crisis so significant for web security?

The recent discovery of the "php2shell" vulnerabilities, specifically CVE-2026-109619, caused massive disruption across the global digital infrastructure. PHP is a cornerstone of the modern web, with some analysts estimating that approximately 70% of all websites currently running on the internet rely on the language. This includes critical sectors such as banking, healthcare, government services, and education.

The php2shell flaws were classified as critical-severity remote code execution vulnerabilities, meaning they could allow threat actors to seize total control over affected web servers. The discovery led to a period of intense panic within the security community. The scale of the potential impact was so vast that several European organizations, particularly in the healthcare and government sectors, preemptively took their websites offline to protect their data while waiting for a patch.

The crisis was further complicated by a breakdown in communication. While the PHP Security Team and select security organizations were working on a fix under an embargo to prevent alerting cybercriminals, information leaked prematurely. This leak, combined with an embargo breach by a security outfit publishing container images before the official patch, led to a massive surge in exploitation attempts. Within hours of the patch release, the number of attempted exploits escalated from a few hundred to millions.

How did ASLR prevent a total catastrophe during the php2shell attacks?

Despite the massive volume of exploitation attempts following the php2shell disclosure, the actual number of successful breaches remained relatively low. This resilience is largely attributed to a memory protection mechanism known as Address Space Layout Randomization (ASLR).

ASLR functions by randomly arranging the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap, and libraries. By constantly changing where a program’s code and data are stored in memory each time it runs, ASLR makes it significantly harder for an attacker to predict the target addresses needed for a reliable exploit.

Yotam Perkal, Director of Security Research at Pluto Security, noted that exploiting php2shell is not a trivial task. According to Perkal, the difficulty in achieving reliable code execution stems from the necessity of bypassing ASLR. He observed that many publicly available Proof of Concepts (PoCs) are unreliable on real-world systems because they fail to account for this memory randomization. However, Perkal cautioned that while ASLR buys time, it is not a permanent solution; as exploit techniques evolve, the protection may become less effective, making timely patching of PHP workers essential.

Frequently asked questions

Is my website immediately at risk from CVE-2026-115560?

Your risk is low unless your application uses a very specific and unusual configuration. You are only vulnerable if you change the session.serialize_handler to php at runtime using ini_set() while having session upload progress enabled. Most standard installations are not affected by this specific bug.

What is the difference between this bug and php2shell?

The primary difference lies in the ease of exploitation and the urgency of the response. The php2shell vulnerabilities were critical, widespread, and easily exploitable, requiring an emergency response. In contrast, CVE-2026-115560 requires highly specific settings, allowing the PHP team to include the fix in a regular scheduled release.

Should I disable session upload progress immediately?

Yes, if you want to ensure full protection before the next regular bugfix release, the PHP Security Team recommends setting session.upload_progress.enabled=0. This is a proactive mitigation step that eliminates the vulnerability's attack vector entirely until the official patch is applied.

Why did the number of exploits increase after the patch was released?

The surge in exploitation attempts was caused by a leak of information regarding the vulnerability before the patch was ready. This alerted threat actors to the existence of the flaw. Additionally, the premature release of fixes by third parties effectively broke the security embargo, leading to millions of attempts.

Does ASLR make my server completely safe from RCE?

No, ASLR is a defense-in-depth measure that makes exploitation much more difficult and less reliable, but it does not prevent it. Attackers can still develop ways to bypass ASLR. Therefore, patching your software remains the most critical step in securing your server against remote code execution.

Key takeaways

• CVE-2026-115560 is a specific RCE vulnerability requiring unusual runtime configuration changes.
• The PHP Security Team will address this flaw in a regular release, not an emergency patch.
• Disabling session upload progress via session.upload_progress.enabled=0 provides immediate mitigation.
• ASLR played a vital role in limiting successful exploits during the recent php2shell crisis.
• PHP powers approximately 70% of the web, making its security a global priority.

The landscape of PHP security remains volatile as new vulnerabilities emerge. While the specific requirements of CVE-2026-115560 provide a reprieve for many administrators, the recent php2shell event serves as a stark reminder of the massive scale at which PHP vulnerabilities can impact the global internet. The combination of high-frequency usage and the complexity of modern memory protections like ASLR creates a continuous cat-and-mouse game between developers and threat actors. Maintaining strict configuration standards and timely patching schedules remains the best defense for any organization relying on PHP infrastructure.