Cybersecurity
PHP issues mitigation for RCE flaw without patch
The PHP security team outlined a temporary defence for CVE-2026-115560, saying the flaw needed an unusual configuration and application pattern, while separate reports described attempted exploitation of earlier PHP vulnerabilities.
- The PHP security team said CVE-2026-115560 could be used for remote code execution only in systems with a particular configuration and application sequence.
- It said administrators could disable session.upload_progress.enabled until a patch arrived, and that installations which had already done so needed no further action.
- The team said it would publish a full advisory with the next release because the setup was unlikely in practice.
- The article said PHP had already patched CVE-2026-109618 and CVE-2026-109619, the two flaws later called PHP2Shell.
- Cloudflare, watchTowr, Previdian, Hadrian and Patchstack said they saw failed exploitation attempts before disclosure, and AWS’s CJ Moses said the picture was still unclear.
The PHP security team said CVE-2026-115560 could be used for remote code execution only when an application and its configuration were arranged in a particular way. That setup required a specific session handler choice, a runtime switch and session upload progress still being enabled.
The team said installations that never changed the serialise handler at runtime could leave the feature on. It said administrators should disable session.upload_progress.enabled until a patch was available, and that anyone who had already done that did not need to act again.
The same mitigation was said to have been needed before PHP patched two other critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Those two bugs were being referred to collectively as PHP2Shell.
Several security companies said they had seen unsuccessful attempts to exploit the PHP2Shell flaws before public disclosure, after details about the vulnerabilities and mitigation advice leaked. Amazon Threat Intelligence said targeting began four days before the patches were released, and AWS chief information security officer CJ Moses said the activity suggested more than one actor and that it was not clear whether any attempt had worked in a real system.
Dataminr’s TRACE team said the activity it observed after disclosure was limited to scanning, fingerprinting and non-working exploit code. It said no compromises were known, while also warning that working proof-of-concept code or successful attacks could still appear later.
Named in this story
People
- CJ Moses
- said the activity suggested multiple actors and that success was unclear
Companies
- VirusTotal
- provided estimates on exposed PHP hosts
- Cloudflare
- said it saw unsuccessful exploitation attempts
- watchTowr
- said it saw unsuccessful exploitation attempts
- Previdian
- said it saw unsuccessful exploitation attempts
- Hadrian
- said it saw unsuccessful exploitation attempts
- Patchstack
- said it saw unsuccessful exploitation attempts
- AWS
- employer of CJ Moses and source of the security statement
- Dataminr
- issued a report on observed activity
Organisations
- PHP security team
- issued the mitigation advice for the flaw
- Amazon Threat Intelligence
- said attackers began targeting the flaws before patches were released
- Threat Research and Cyber Engineering (TRACE) team
- said observed activity stayed limited to scanning and non-working exploits
Products and systems
- PHP
- the language and runtime affected by the vulnerabilities
- PHP2Shell
- the label used for the two earlier critical PHP flaws
How the source tells it
Mostly a technical advisory, with attributed claims about exposure and attempted exploitation rather than editorial alarm.
No emotive framing was found in the original.