Third PHP2Shell RCE vulnerability identified, but no emergency fix planned

Following the discovery of the PHP2Shell vulnerabilities, researchers have identified a third RCE flaw, designated as CVE-2026-115560. The PHP Foundation stated that this flaw will not receive an emergency patch because it relies on an unlikely combination of configuration settings and application code. Instead, a fix will be included in the next regular PHP release, and users are advised to mitigate the risk via configuration in the meantime.

Technical requirements for CVE-2026-115560

• The vulnerability requires the session.upload_progress.enabled feature to be active.
• It specifically affects applications that set session.serialize_handler to php_binary or php_serialize in their configuration.
• The exploit requires the application to switch this handler to php at runtime using ini_set() before calling session_start().
• The PHP Foundation recommends setting session.upload_progress.enabled=0 as a temporary mitigation.

Why it matters

While the first two PHP2Shell vulnerabilities posed a massive risk to the web, this third flaw is considered low-risk due to its specific requirements, though it highlights the ongoing security challenges for the PHP ecosystem.