PHP Maintainers Refuse Emergency Patch for New PHP2Shell Bug

Why PHP skipped an out-of-band release

Maintainers determined the flaw requires a rare combination of custom runtime configuration values, reducing the immediate threat to production servers.

Fresh off the scramble to patch the original PHP2Shell zero-day (tracked as CVE-2026-109619), the PHP Security Team has disclosed another remote code execution vulnerability involving session handling. This time, however, maintainers are holding off on a rapid-response patch.

The vulnerability, tracked as CVE-2026-115560, resides in PHP's session upload progress mechanism. Unlike the panic that gripped server administrators just days ago, maintainers argue this bug's attack surface is drastically narrower.

To abuse it, a web application must first set its serialize handler to either php_binary or php_serialize in php.ini, switch that handler to plain php at runtime using ini_set(), and do so immediately before calling session_start(). Unless an application intentionally juggles these handlers mid-execution while upload progress tracking remains active, the vector stays dormant.

CVE-2026-115560: Tracking, severity, and mitigation

The fallout from the original PHP2Shell leak

The collective anxiety surrounding PHP vulnerabilities is understandable given what occurred earlier this month. The original PHP2Shell disclosure spiraled out of control when an embargo broke prematurely, prompting mass scanning across the web. AWS reported active exploit attempts four days ahead of scheduled remediation.

When security vendors published container fixes early, opportunistic attackers began firing millions of exploit payloads. Across Europe, several government, healthcare, and university portals temporarily took systems offline to insulate themselves.

Yet despite the chaotic disclosure, confirmed breaches remained surprisingly rare. Security researchers point to Address Space Layout Randomization (ASLR) on modern Linux kernels as the primary roadblock blunting automated attacks. Exploiting deep memory quirks remotely without crashing the host worker process remains technically demanding, even as automated tooling improves—a trend TechCortex analyzed when AI resurrected legacy PHP bugs previously thought harmless.

How sysadmins can neutralize the bug right now

Waiting for regular distribution updates does not mean administrators should do nothing. The mitigation requires editing a single directive across your fleet.

Disabling upload progress monitoring entirely closes the vulnerability window without breaking modern web frameworks, which generally handle upload metrics on the client side or via reverse proxies.

Teams that already applied workarounds for CVE-2026-109619 by turning off session upload progress are already protected against CVE-2026-115560.

• Locate your active php.ini file across all web worker nodes.
• Set session.upload_progress.enabled = 0.
• Restart PHP-FPM or your web server daemon to apply the change immediately.
• Keep the setting disabled until your Linux distribution bundles the next scheduled upstream PHP point release.

Availability and impact for enterprise environments

The fix for CVE-2026-115560 will arrive in standard maintenance releases across Debian, Ubuntu, Red Hat Enterprise Linux, and upstream PHP channels on their ordinary release cycles. System administrators managing cloud infrastructure in North America and Europe do not need to alter change-management schedules or organize emergency midnight maintenance windows, provided their applications run stock session configurations.