PHP disclosed a new code execution flaw on Friday. The patch is not out yet.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Friday 23 October 2026 the PHP team disclosed CVE-2026-115560, a remote code execution flaw with no patch yet, BleepingComputer reports. It needs session.serialize_handler set to php_binary or php_serialize, switched to php with ini_set() before session_start(), and session upload progress left on.
Why it matters
The PHP team calls the setup unlikely in practice. But you only find out whether your legacy login code switches handlers when someone greps for it. And this lands days after the PHP2Shell fixes, with attackers already probing PHP servers.
What to do
Search your code for ini_set calls on session.serialize_handler today. If any exist, set session.upload_progress.enabled=0 until the next PHP release ships the fix.
A mitigation with no patch is a sticky note on the door. Put it up today, and check that nobody peels it off at the next deploy.
Lior Aharonov · my takeSources
| BleepingComputer: PHP shares mitigation for new RCE vulnerability with no patch | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.