StableReported 2026-10-24 13:46

PHP Foundation warns of unpatched RCE vulnerability CVE-2026-115560

The PHP Foundation disclosed a new remote code execution vulnerability (CVE-2026-115560) two days after the PHP2Shell patch, warning that it remains unpatched; the recommended mitigation is setting session.upload_progress.enabled to 0.

Why it matters. PHP powers a significant portion of the web; an unpatched RCE affects many sites, especially those with the rare configuration where session.serialize_handler is set to php_binary or php_serialize and upload progress is enabled.

Who and what it touches

Into PHP Foundation

Cloudflarepartners with
OpenSSFpartners with

From PHP Foundation

PHPuses
PHP patchesproduces
PHP projectscapacity constraint
Websitesenables
研究者partners with

Each line is a relation with evidence behind it, drawn in the direction it points. A line shows that two things are connected, not how far this change reaches.

Evidence

IiThome（台灣）Media2026-10-24 13:46
View source