# Third PHP2Shell RCE vulnerability identified, but no emergency fix planned

> **Key takeaway:** A third remote code execution vulnerability (CVE-2026-115560) has been found in PHP, but it requires a highly specific configuration to be exploitable.

**Published:** 2026-10-23T20:04:40+00:00 
**Source:** The Register 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/third-php2shell-rce-vulnerability-identified-but-no-emergenc.html 

## Summary
Following the discovery of the PHP2Shell vulnerabilities, researchers have identified a third RCE flaw, designated as CVE-2026-115560. The PHP Foundation stated that this flaw will not receive an emergency patch because it relies on an unlikely combination of configuration settings and application code. Instead, a fix will be included in the next regular PHP release, and users are advised to mitigate the risk via configuration in the meantime.

## Technical requirements for CVE-2026-115560
- The vulnerability requires the **session.upload_progress.enabled** feature to be active.
- It specifically affects applications that set **session.serialize_handler** to **php_binary** or **php_serialize** in their configuration.
- The exploit requires the application to switch this handler to **php** at runtime using **ini_set()** before calling **session_start()**.
- The PHP Foundation recommends setting **session.upload_progress.enabled=0** as a temporary mitigation.

## Why it matters
While the first two PHP2Shell vulnerabilities posed a massive risk to the web, this third flaw is considered low-risk due to its specific requirements, though it highlights the ongoing security challenges for the PHP ecosystem.