PHP Has an Unpatched RCE, CVE-2026-115560, That Needs Three Conditions Including a Runtime Serialize-Handler Switch

A remote attacker can reach code execution through CVE-2026-115560 only if a PHP application changes its session serialize handler at runtime and session upload progress is still switched on, the PHP team said in an informational advisory on October 23. No patch exists yet.

The advisory calls it "an unlikely RCE vector" and says it will be fixed in the regular release cycle, with a full advisory for the CVE published alongside the next release. The entry gives no CVSS score and no affected versions.

The three conditions

PHP's text is precise about what has to be true at the same time. An application must set session.serialize_handler to php_binary or php_serialize in its configuration, then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled.

Condition	What must be true
Configured handler	php_binary or php_serialize
Runtime behavior	ini_set() switches the handler to php before session_start()
Feature flag	session.upload_progress.enabled is on

Applications that never change the serialize handler at runtime can keep the feature enabled, according to the advisory. That is the practical test: search the code base for ini_set calls touching session.serialize_handler. If there are none, this advisory does not describe your application.

The mitigation is one already on many checklists

PHP recommends setting session.upload_progress.enabled=0 until the next regular bugfix release. The same setting was listed as a mitigation for CVE-2026-109619, one of the two PHP2Shell flaws, in advisory GHSA-6wmf-4rv5-p3rp published October 21. PHP's note says anyone who applied it then should keep it in place and take no further action.

Aikido's PHP2Shell write-up gives the mechanics for applying it. The setting has to go in php.ini, the FPM pool or server configuration, applied before request parsing, and workers must be restarted. ini_set() and .user.ini do not work. Aikido also says to keep the setting at 0 after patching, and notes that session upload progress is enabled by default and was one of two confirmed paths for CVE-2026-109619.

That overlap matters for sequencing. The 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releases of October 21 fixed the two PHP2Shell bugs, as The Terminal reported, but PHP says it is handling CVE-2026-115560 in the regular cycle. A patched server that never applied the setting is therefore the case PHP's note is aimed at.

What is known about exposure and exploitation

BleepingComputer, in a report by Sergiu Gatlan published October 23, cites a VirusTotal estimate of more than 5.1 million PHP hosts exposed online, about 3.8 million of them with at least one open port. That counts PHP hosts, not hosts meeting the three conditions, and the true exposed set is smaller by an amount nobody has published.

BleepingComputer reports no exploitation of CVE-2026-115560 itself. Its exploitation details concern PHP2Shell: Amazon Threat Intelligence said attackers began targeting those flaws four days before the patches, while Dataminr reported only scanning, fingerprinting and non-working exploits, with no known compromises. The Terminal covered that split in its Amazon and Dataminr report.

The vulnerability, as opposed to an exploit or exploitation in the wild, is all that is documented. No proof of concept is cited in either source.

What to do now

Set session.upload_progress.enabled=0 at the server level and restart workers. Grep for session.serialize_handler in ini_set calls. Then watch php.net for the next regular bugfix release, which is when PHP says the full advisory, with versions and a score, will appear.