PHP Security Alert: New RCE Vulnerability - What Organisations Should Do Now
Security teams should follow a structured response that combines configuration changes, software updates, operational testing, and verification.
Step 1: Identify every PHP deployment
Build an inventory of systems that use PHP, including:
Public-facing websites and web applications.
Customer portals and internal business applications.
PHP-based content management systems.
Applications hosted on cloud infrastructure or virtual machines.
Containerised workloads and managed hosting environments.
Third-party products and appliances that bundle PHP.
Include development, testing, staging, and production environments where applicable. An application may remain exposed through a neglected server, a secondary deployment, or a third-party component even after the primary production environment has been updated.
Step 2: Apply the emergency security updates
Verify that the October 21 security updates for CVE-2026-109618 and CVE-2026-109619 have been deployed across affected systems.
The PHP project identifies the following patched releases for the relevant supported branches:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
Confirm the appropriate release for each deployment and check whether the operating system vendor or hosting provider supplies a backported security fix.
Do not assume that an older-looking package is vulnerable or that a newer version is automatically protected without checking the vendor's security information. Package numbering and backport practices vary across distributions.
Where immediate patching is not possible, apply a documented risk-reduction plan and assess whether exposed services should be isolated until remediation is completed.
Step 3: Disable PHP session upload progress where appropriate
The PHP project's recommended temporary mitigation is:
session.upload_progress.enabled = 0
This setting disables PHP's session upload progress feature.
Administrators should determine how the application currently manages session settings and where its effective PHP configuration is defined. Depending on the deployment, configuration may be controlled through php.ini, PHP-FPM pool settings, server configuration, container images, or hosting-provider controls.
After applying the change:
Verify that the intended configuration has taken effect.
Restart or reload the relevant PHP workers as required by the deployment and vendor guidance.
Test file uploads, progress indicators, and related application functionality.
Confirm that the mitigation persists after a service restart or deployment.
Record the change, its verification results, and any remaining limitations.
Disabling upload progress does not disable all file uploads. However, applications that depend on PHP's progress-tracking mechanism may require testing or adjustments.
Important: This configuration change is a temporary mitigation for CVE-2026-115560. It is not a substitute for installing the earlier PHP2Shell security updates.
Step 4: Review application session handling
Development and application security teams should inspect the code responsible for session initialisation.
Look for runtime changes to session.serialize_handler, particularly where ini_set() is used before session_start().
Review shared bootstrap files, application frameworks, custom middleware, and third-party libraries. Centralising session configuration and avoiding unnecessary runtime changes can reduce configuration complexity and make future vulnerability assessments more reliable.
Document any affected code paths and test the proposed changes in a controlled environment before deploying them to production.
Step 5: Investigate suspicious activity
Patching closes a known vulnerability path, but it does not establish whether a system was compromised before remediation.
Review web server and application logs for unusual requests, unexpected process execution, suspicious file modifications, unfamiliar outbound connections, and other signs of unauthorised activity.
The investigation should consider the exposure period preceding the public disclosure of the earlier PHP2Shell vulnerabilities, not merely the date on which an update became available.
If evidence suggests a possible compromise, preserve relevant logs and forensic data, follow the organisation's incident response process, and escalate to qualified security personnel.
Why Threat Monitoring Matters: Exploitation Attempts Before Public Disclosure
A particularly important development in the PHP2Shell incident came from Amazon Threat Intelligence.
In its report published on 21 October 2026, Amazon described a PHP2Shell exploitation attempt detected by its MadPot honeypot network on 17 October, four days before public disclosure of the two earlier vulnerabilities.
Additional attempts were observed around the disclosure period.
These observations demonstrate why security teams should not assume that a vulnerability becomes relevant only when its details appear publicly. Attackers may obtain information through other channels, while defenders may need time to identify affected systems and complete remediation.
However, an attempted exploit is not proof of a successful intrusion. The available reporting concerning the earlier PHP2Shell vulnerabilities should also not be misrepresented as evidence that CVE-2026-115560 has been exploited.
For organisations, the appropriate response is to combine timely patching with a review of historical activity, using evidence to determine whether further investigation is necessary.
Security monitoring should also extend beyond known vulnerability signatures. Suspicious process creation, unexpected access to sensitive files, abnormal outbound traffic, and unexplained changes to application directories may reveal activity that signature-based detection misses.