PHP warns of unpatched session upload RCE 48 hours after emergency PHP2Shell updates

Maintainers decline emergency release 48 hours after PHP2Shell scramble

Exactly 48 hours (derived) after issuing emergency out-of-cycle releases for the critical CVSS 9.2 PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the PHP development project has published an informational security advisory regarding another potential remote code execution vector. Tracked as CVE-2026-115560, the flaw resides in PHP's built-in session upload progress mechanism. However, in stark contrast to Wednesday's emergency cycle, the PHP security team has formally declined to issue an out-of-cycle emergency patch, scheduling the permanent remediation for the routine monthly bugfix cycle in mid-November and leaving server fleets exposed to a 20-day unpatched window (derived).

The decision to defer a binary release hinges on the maintainers' assessment that triggering CVE-2026-115560 requires an unusual combination of configuration parameters and application runtime logic. To achieve arbitrary code execution, a target application must enable session upload progress, configure its serialization handler to binary or serialize formats, and dynamically modify that handler to standard PHP format at runtime using ini_set() prior to calling session_start(). While maintainers classify this sequence as rare, the disclosure lands while enterprise incident response teams are actively battling millions of automated scans from threat actors attempting to weaponise unpatched web infrastructure with Mirai botnet implants.

What the advisory establishes and what the security record leaves unstated

To determine whether web application infrastructure requires urgent configuration intervention, engineering leads must separate the verified technical mechanics of CVE-2026-115560 from broad alarmism.

Audit of verified technical disclosures for CVE-2026-115560 versus operational deployment assumptions

Technical Dimension	Explicitly Established in PHP Advisory	Not Stated or Dependent on Environment
Vulnerability Vector	Object injection leading to remote code execution via session upload progress deserialisation mismatches.	Publicly available Property-Oriented Programming (POP) gadget chains weaponised for specific PHP frameworks.
Required Handler State	session.serialize_handler set to php_binary or php_serialize, then changed to php via ini_set().	The total number of legacy enterprise or custom PHP applications running dynamic serialization switches.
Execution Timing	The runtime handler change must execute before session_start() is called by the application.	Whether popular framework routing middlewares execute ini_set() within this vulnerable window.
Remediation Mechanism	Setting session.upload_progress.enabled = 0 provides immediate, complete mitigation.	Why the feature was left enabled by default in official distributions if declared inherently risky.
Active Exploitation	Zero confirmed in-the-wild exploitation attempts reported for CVE-2026-115560 at disclosure.	Whether threat actors scanning for PHP2Shell are testing session deserialisation payloads concurrently.

The friendly-name fallacy: why rare configuration assumptions breed risk

The architectural debate surrounding CVE-2026-115560 highlights a recurring friendly-name fallacy in open-source vulnerability management: the belief that classifying a flaw as dependent on an unusual configuration justifies withholding binary updates. In modern cloud environments hosting diverse multi-tenant workloads, bespoke software modules, and legacy content management systems, complex runtime configuration adjustments are far more prevalent than maintainers assume.

The vulnerability stems from an impedance mismatch between PHP's internal session serialization formats. When PHP processes a multipart file upload containing a PHP_SESSION_UPLOAD_PROGRESS parameter, it automatically creates a tracking array inside $_SESSION using the globally configured session.serialize_handler. In php_binary format, property names are stored alongside their byte-length markers. However, if the application subsequently switches the handler to php at runtime, the engine expects key-value pairs delimited by vertical pipe characters (|).

Zoom

As illustrated in the technical architecture diagram, an attacker can embed pipe characters inside the file upload field name. When PHP reads the stored session file using the switched php handler, the parser misinterprets the injected pipe character as a boundary marker, reading attacker-supplied bytes directly into the deserialiser. If the application contains suitable classes with magic methods such as __destruct() or __wakeup(), the deserialisation process instantiates arbitrary object chains, yielding remote code execution in the context of the web server worker process.

Immediate configuration defense and the 20-day release gap

Because the PHP development team deferred packaging official binary releases until mid-November, system administrators and DevSecOps engineers must implement defensive configuration controls directly within php.ini or PHP-FPM pool definitions:

; Mitigate CVE-2026-115560 and CVE-2026-109619 across all PHP workers
[Session]
session.upload_progress.enabled = 0

; Ensure immutable serialization handler across runtime execution
session.serialize_handler = php

Setting session.upload_progress.enabled = 0 completely disables the automated insertion of upload progress metadata into session files, neutralising the injection primitive without affecting standard file upload functionality. Remarkably, this identical directive was previously highlighted as an optional hardening measure in the GitHub advisory GHSA-6wmf-4rv5-p3rp for PHP2Shell on 21 October. Organizations that implemented rigorous configuration hardening during Wednesday's emergency cycle are already insulated from CVE-2026-115560.

UK regulatory governance and defense-in-depth obligations

For UK organisations operating digital services and transactional portals, the emergence of CVE-2026-115560 on the heels of PHP2Shell tests compliance with core regulatory expectations. Under the UK National Cyber Security Centre (NCSC) Vulnerability Management Principles, organisations are expected to distinguish between vendor-supplied binary patches and runtime configuration mitigations, ensuring that security postures do not depend exclusively on upstream release schedules.

Under Cyber Essentials Requirements for Infrastructure v3.3, high-risk vulnerabilities must be remediated within 14 days of disclosure. When upstream maintainers decline to issue out-of-cycle package updates, organisations that rely solely on automated apt or yum update pipelines remain non-compliant. Implementing documented configuration mitigations satisfies Cyber Essentials requirements while upstream packages remain pending.

Furthermore, under the UK Data Protection Act 2018 and UK GDPR Article 32, organisations processing customer information must maintain state-of-the-art technical security controls. In an environment where automated botnets are aggressively probing web infrastructure, leaving unhardened PHP runtimes exposed to potential object injection compromises data confidentiality and risks regulatory scrutiny from the Information Commissioner's Office (ICO).

Defender checklist: hardening PHP session configurations

The exposing question

When your vulnerability management strategy relies on automated operating system package updates, how many web services remain exposed when upstream maintainers decide an RCE vector is too rare to justify an emergency patch?

Key facts