PHP shares mitigation for unpatched RCE vulnerability

The PHP security team has disclosed a new remote code execution vulnerability, tracked as CVE-2026-115560, which currently has no patch and affects systems with non-default configurations. The team has provided mitigation measures to address the flaw. The vulnerability can only be exploited when an application changes its session serialize handler at runtime using ini_set() before calling session_start(), with session upload progress enabled. The PHP team recommends setting session.upload_progress.enabled=0 as a temporary mitigation until a fix is released in the next regular cycle. This disclosure follows Wednesday's patching of two critical RCE vulnerabilities, collectively known as PHP2Shell, which are now seeing broad exploitation attempts in the wild. Multiple security firms detected unsuccessful attack attempts before patches were released, with Amazon Threat Intelligence noting attackers targeted the flaws four days prior.