PHP RCE Storm: Unpatched CVE-2026-115560 Joins Actively Exploited PHP2Shell Flaws

As reported by BleepingComputer, the PHP security team disclosed a new unpatched remote code execution vulnerability on October 23, 2026, compounding an already turbulent week for the PHP ecosystem. The disclosure arrives alongside confirmation that the recently patched PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are now seeing broad exploitation attempts in the wild.

Vulnerability Summary

Affected ecosystem: PHP runtime environments, particularly the ~5.1 million PHP hosts exposed online per VirusTotal estimates. CVE-2026-115560 specifically requires a non-default configuration: session.serialize_handler set to php_binary or php_serialize, switched to php at runtime via ini_set() before session_start(), with session upload progress still enabled.

Why This Matters Beyond the Headline

The convergence of these three vulnerabilities creates a perfect storm for PHP-based infrastructure. PHP powers nearly 70% of all websites — a staggering attack surface that makes even niche configuration vulnerabilities significant at scale. While CVE-2026-115560 requires an unusual configuration combination that the PHP team acknowledges is unlikely in practice, defenders should not be complacent. "Unlikely" in a population of 5 million exposed hosts still translates to thousands of potentially vulnerable systems.

The more urgent story is the PHP2Shell situation: attackers began targeting CVE-2026-109618 and CVE-2026-109619 four days before patches were even available, after vulnerability details leaked to critical infrastructure providers and circulated publicly.

This pre-disclosure exploitation window — confirmed by Amazon Threat Intelligence, Cloudflare, watchTowr, and others — represents a serious breakdown in coordinated disclosure. Multiple threat actors independently attempted exploitation with varying payloads and anonymization infrastructure, suggesting the leaked details spread broadly enough to reach multiple criminal groups. While PHP's team noted that published PoCs were non-functional, the fact that exploitation attempts preceded the patch by four days means organizations that were slow to patch on release day have already been exposed.

Who Is Most at Risk

• Unpatched PHP environments: Any system still running vulnerable PHP versions without the PHP2Shell patches applied is at immediate critical risk
• Applications using runtime serialize_handler changes: The specific ini_set() pattern required for CVE-2026-115560 is uncommon but exists in some session-handling libraries and legacy applications
• Internet-facing PHP hosts: The 3.8 million hosts with open ports identified by VirusTotal are the primary target demographic
• Shared hosting environments: Where tenants may use non-standard configurations that hosting providers cannot easily inventory

Shield53 Recommendations

Immediate Actions:

• Apply the PHP2Shell patches NOW — if you haven't updated PHP since October 22, do so immediately. Active exploitation is confirmed.
• Set session.upload_progress.enabled=0 across all PHP environments as mitigation for CVE-2026-115560. If you already applied this on October 21 per PHP's guidance, no further action is needed for this specific flaw.
• Audit your PHP configurations — search your codebase and configuration files for runtime ini_set('session.serialize_handler', ...) calls combined with session_start(). Any match indicates potential exposure to CVE-2026-115560.
• Review access logs — look for anomalous session-related requests dating back to October 19, when PHP2Shell targeting began. Indicators include unexpected multipart/form-data POSTs to session-handling endpoints.
• Inventory your PHP version exposure — identify all internet-facing PHP hosts and confirm patch status. The scale of exposed hosts makes this a priority for any organization with a web presence.

Strategic considerations: The pre-disclosure leak that enabled four days of exploitation before patches were available should prompt a reevaluation of how critical vulnerability information is shared with infrastructure providers. Organizations relying on PHP should also consider whether their session handling patterns are defensible — runtime serialization handler changes are a code smell that creates unnecessary exposure. If your application genuinely requires a non-default serializer, use a consistent configuration rather than runtime switching.

The PHP team's decision to handle CVE-2026-115560 in the regular release cycle rather than issuing an out-of-band patch is reasonable given the narrow exploitation conditions, but defenders in heavily regulated industries or those with large PHP estates may want to apply the upload progress mitigation regardless and monitor for the next PHP release that will include the full fix.