Introduction: Another PHP Security Vulnerability Demands Attention
Web application security remains a critical concern for organisations that depend on online platforms, customer portals, business applications, and digital services. Recent security disclosures involving PHP have reinforced the importance of proactive vulnerability management, timely patching, and continuous security monitoring.
On 23 October 2026, the PHP security team disclosed a new potential remote code execution (RCE) vulnerability, CVE-2026-115560, involving PHP session handling and upload progress functionality. The announcement followed emergency security releases addressing two earlier vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively associated with the PHP2Shell security incident.
Unlike the earlier vulnerabilities, the newly disclosed issue requires a specific combination of application code and configuration settings. PHP recommends disabling session upload progress until a fix becomes available through its regular release cycle.
For organisations operating PHP-powered websites and applications, this development highlights an important security principle: installing available patches is essential, but effective protection also requires configuration reviews, exposure assessments, threat monitoring, and documented remediation.
At Xyber, we believe cybersecurity should be treated as an ongoing operational responsibility rather than a one-time technical exercise. Understanding emerging vulnerabilities enables organisations to make informed decisions, protect critical systems, and strengthen their cybersecurity and compliance programmes.
Understanding CVE-2026-115560: The Newly Disclosed PHP Vulnerability
Remote code execution vulnerabilities can allow an attacker to execute commands or code on a vulnerable system. Depending on the affected component, system privileges, and application architecture, successful exploitation can threaten data confidentiality, system integrity, and service availability.
CVE-2026-115560 concerns an interaction between PHP's session serialisation mechanism and its session upload progress feature.
PHP sessions allow applications to retain information associated with users across requests. Upload progress functionality enables applications to monitor the progress of file uploads. The newly identified issue arises when particular session configuration settings interact with application code in an unexpected sequence.
According to the PHP security team's preliminary notice, the vulnerable condition requires all the following circumstances:
The application initially configures session.serialize_handler as php_binary or php_serialize.
Application code subsequently changes the setting to php using ini_set().
This change occurs before the application calls session_start().
PHP session upload progress remains enabled.
The vulnerability is therefore configuration-dependent. Applications that never change the serialisation handler at runtime are not exposed through this particular attack path merely because upload progress is enabled.
As of 29 October 2026, PHP's published notice recommends disabling session upload progress until a regular bug-fix release becomes available. The complete technical advisory and definitive release information should be checked against the vendor's latest announcement before making remediation decisions.
Why this matters: Organisations cannot reliably determine exposure by checking a PHP version number alone. Application bootstrap logic, runtime configuration changes, hosting architecture, and enabled session features also influence the assessment.
PHP2Shell: How the Earlier Vulnerabilities Differ
The latest disclosure follows emergency patches released on 21 October 2026 for two separate PHP vulnerabilities.
Understanding their differences is important because the mitigation for the newly disclosed issue does not replace the security updates required for the earlier flaws.
1. CVE-2026-109618: Memory exhaustion handling
This vulnerability concerns PHP's handling of memory exhaustion and the resulting internal request state.
Under affected circumstances, memory exhaustion can interrupt normal processing before internal data has been fully initialised. Subsequent cleanup operations may then encounter an invalid state, creating a potential route to remote code execution.
PHP's technical advisory describes exploitation against Apache deployments using mod_php, with the potential for code to execute under the web worker's operating-system account.
The risk depends on the runtime environment and relevant implementation details. Organisations should follow PHP's vendor guidance and deploy the applicable security release.
2. CVE-2026-109619: Use-after-free condition
The second vulnerability involves memory that has been released while related internal state can still be accessed.
This type of defect, commonly known as a use-after-free vulnerability, can produce unpredictable behaviour and potentially enable an attacker to execute code.
PHP's advisory describes several contributing execution paths involving internal runtime operations. Session handling and upload progress are relevant to the investigation, but the vulnerability is not limited to the newly disclosed configuration scenario.
3. CVE-2026-115560: Session upload progress and configuration changes
The latest disclosure identifies another potential RCE path involving a specific sequence of session serialisation settings and upload progress processing.
PHP is addressing this issue through its regular release cycle and recommends disabling the relevant feature until a fix becomes available.
Security takeaway: Treat all three vulnerabilities as separate remediation items. Apply the appropriate security updates for the earlier issues, implement the recommended mitigation for CVE-2026-115560, and verify that each action has been completed successfully.