PHP Shares Mitigation for New Unpatched RCE Vulnerability
The PHP security team has released mitigation advice for a new remote code execution vulnerability that impacts systems with specific non-default configurations.
Radwan AbdulhadiEditor and technology writer
New Vulnerability Details and Mitigation
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and currently has no patch available. PHP is an open-source web development language utilized across the internet, with <a href="https://w3techs.com/technologies/details/pl-php">nearly 70%</a> of all websites relying on the technology.
According to VirusTotal estimates, millions of PHP hosts are exposed online with open ports. In a Friday advisory, the security flaw—tracked as CVE-2026-115560—was noted to only be exploitable when targeting systems operating with an unusual combination of configuration settings and application code.
Specific application requirements must be met for exploitation to occur. As <a href="https://www.php.net/">the PHP team explained</a>, an application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime using ini_set() prior to calling session_start(), with session upload progress also enabled.
Applications that never alter the serialize handler at runtime can safely keep the feature enabled. Because this setup is considered unlikely in practice, the development team is handling the issue within the regular release cycle and plans to publish a full advisory alongside the next release.
Recommended Temporary Fixes
Until an official security patch is officially released, PHP developers have suggested setting session.upload_progress.enabled=0. The advisory notes that if this mitigation was applied previously, administrators can keep it in place with no further action required.
This specific mitigation aligns with steps that should have already been applied by Wednesday, prior to patching two separate critical remote code execution vulnerabilities.
Context on Recent PHP2Shell Flaws
The latest advisory arrives closely following emergency updates for other major security issues. <a href="https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/">The PHP security team patched</a> two critical remote code execution vulnerabilities, which are <a href="https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/">tracked collectively as PHP2Shell</a>, just one day after <a href="https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/">urging admins</a> to prepare for the updates.
While proof-of-concept code surfaced before the emergency patches went live, the PHP security team confirmed that none of the published samples were functional at the time.
Early Exploitation Attempts and Observation
Despite non-functional proof-of-concept codes, multiple cybersecurity organizations detected unsuccessful exploitation attempts prior to public disclosure. Details concerning the PHP2Shell flaws, including CVE identifiers and mitigation guidance shared with critical infrastructure providers, leaked online ahead of the patch release.
Security researchers at Amazon Threat Intelligence reported that malicious actors began targeting the PHP2Shell vulnerabilities four days before the security patches were issued on Wednesday. AWS chief information security officer CJ Moses noted that the payloads and anonymization infrastructure varied, indicating multiple actors.
Dataminr's Threat Research and Cyber Engineering team reported that observed activity since disclosure remained largely restricted to scanning, fingerprinting, and non-working exploits, though experts warn that working proofs-of-concept are likely to emerge over time.
Sources
- BleepingComputerPHP shares mitigation for new RCE vulnerability with no patch
Continue chronologically
Related entity coverage
Related stories
PHP2Shell Flaws Successfully Exploited in the Wild
Critical PHP2Shell remote code execution vulnerabilities are now successfully exploited in the wild following early disclosures and leaks.
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
Amazon: PHP2Shell Exploitation Began Days Before Patches
Amazon Threat Intelligence reveals that threat actors began targeting critical PHP2Shell vulnerabilities four days before emergency patches were released.
PHP2Shell Leaked Critical Flaws Loom Over Servers
Details on critical PHP2Shell vulnerabilities have leaked online, prompting urgent warnings of potential mass exploitation and fast patch preparation.
