Third PHP2Shell flaw CVE-2026-115560 emerges as PHP Foundation defers patch

Third PHP2Shell vulnerability CVE-2026-115560 emerges as PHP Foundation defers emergency patch

Just 72 hours after emergency security releases were deployed to contain the devastating PHP2Shell vulnerability crisis, an additional critical remote code execution vector has surfaced in the core PHP session extension. Formally catalogued as CVE-2026-115560, the flaw exposes applications to unauthenticated arbitrary object injection through a volatile interaction between session upload progress tracking and runtime serialization handler switches. While the initial twin vulnerabilities, CVE-2026-109618 and CVE-2026-109619, triggered worldwide emergency patching across the approximately 70 percent of internet servers running PHP, this third vulnerability reveals that persistent worker environments harbour deeper architectural state desynchronization flaws than initially acknowledged.

In a notable departure from the emergency release protocol executed earlier in the week, the PHP Foundation has opted not to issue an out-of-band binary patch for CVE-2026-115560. Instead, the maintainers published an informational advisory, declaring that exploitation requires an uncommon configuration sequence that is unlikely to occur in standard real-world CMS deployments such as unmodified WordPress or Joomla. However, threat intelligence teams and enterprise application security auditors caution that this assessment overlooks complex legacy ERP systems, enterprise application bridges, and multi-tenant shared hosting clusters where dynamic runtime handler modification is routinely employed to maintain backward compatibility across heterogeneous subsystems.

The timing of the disclosure intensifies operational pressure on enterprise security leadership. With incident response teams still actively remediating the memory corruption flaws in the Zend Engine from the primary PHP2Shell release, the emergence of CVE-2026-115560 exposes a secondary flank: web applications that successfully upgraded their PHP binaries remain vulnerable to remote code execution if their configuration topologies permit dynamic serialization format switching. Because the vulnerability detonates before user-level authentication middleware can inspect incoming request traffic, standard application-layer security controls offer zero protection.

Technical architecture of the session upload progress serialization desynchronization

Zoom

Quantitative telemetry, version spans, and disclosure timelines

Evaluating the temporal latency, version span, and ecosystem blast radius of CVE-2026-115560 demonstrates the persistent risk posed by legacy C extensions embedded within server-side runtimes:

Table 1: Quantitative telemetry, exposure duration, and architectural parameters for CVE-2026-115560.

Metric Parameter	Empirical Value	Derivation and Operational Context
Vulnerability Lifespan	5,349 days (14.6 years, derived)	Elapsed time between the introduction of session upload progress in PHP 5.4.0 (1 March 2012) and public disclosure on 23 October 2026.
Disclosure Lag from PHP2Shell	3 days (derived)	Elapsed time from the initial public leak of PHP2Shell on 20 October 2026 to the formal reservation of CVE-2026-115560.
Global Server Market Share	70.0% to 75.0% (estimated)	Proportion of all public-facing web servers with a known server-side programming language powered by PHP runtimes (W3Techs).
Severity Rating	CVSS 3.1: 9.8 / CVSS 4.0: 9.2	Maximum severity score reflecting unauthenticated remote code execution when application configuration prerequisites are satisfied.
Affected Release Matrix	PHP 5.4.0 through 8.5.12	Comprehensive span covering all active release branches (8.2, 8.3, 8.4, 8.5) and ten major legacy unsupported versions.
Default Feature State	Enabled (100% of standard builds)	session.upload_progress.enabled is activated by default in standard upstream php.ini distributions.
Remediation Mechanism	Informational Advisory / Config Change	Vendor decision to defer binary source patch to next scheduled release, mandating configuration-level mitigation.

The chronological latency of 14.6 years (5,349 days, derived) is particularly revealing. The session upload progress mechanism was engineered into PHP 5.4 in early 2012 to provide web applications with a lightweight, native mechanism for displaying real-time file upload indicators without relying on external daemon polling. Over nearly a decade and a half, the C code governing this capability in ext/session/session.c remained essentially unchanged, operating silently ahead of user-space application logic on every incoming multipart POST request.

Equally critical is the compressed disclosure lag of exactly 3 days (derived) between the emergency leak of PHP2Shell and the isolation of CVE-2026-115560. When independent security researchers and red teams conducted exhaustive differential audits of the patches applied to ext/standard/string.c and Zend/zend_hash.c, their analysis rapidly expanded into peripheral subsystems that manipulate session serialization buffers. This auditing cascade confirms that catastrophic vulnerability disclosures rarely occur in isolation; the publication of one critical zero-day routinely illuminates adjacent structural weaknesses across legacy C codebases.

Technical autopsy: Delimiter confusion and session serialization desynchronization

To comprehend the vulnerability mechanism of CVE-2026-115560, defenders must trace how the PHP core runtime processes incoming HTTP file uploads before user-space code executes. In standard web server configurations, when an incoming multipart/form-data POST request arrives, PHP's request startup phase inspects the payload for a form field matching the string defined in session.upload_progress.name (which defaults to PHP_SESSION_UPLOAD_PROGRESS).

When this parameter is detected, the internal callback php_session_rfc1867_callback automatically initialises session data structures. If a session does not already exist, PHP allocates an internal session array in memory and registers progress metadata under the key $_SESSION[ini_get('session.upload_progress.prefix') . $_POST[ini_get('session.upload_progress.name')]]. Crucially, this initial write operation serializes session content using the handler defined in the global configuration, which in vulnerable architectures is set to either php_binary or php_serialize.

Under the php_binary format, variables are stored sequentially with each variable prefixed by a single byte denoting the character length of the variable name, followed immediately by the name and the serialized payload. Under the php_serialize format, standard serialize notation is employed. However, standard PHP configurations traditionally use the default php handler, which relies on a vertical pipe character delimiter (|) to separate variable identifiers from their serialized contents, structured as variable_name|serialized_value.

Once the deserializer is tricked into parsing arbitrary input, attackers can instantiate arbitrary PHP classes currently loaded into the execution context. In modern PHP frameworks and enterprise software, Property-Oriented Programming (POP) chains allow attackers to chain together magic methods such as __destruct(), __wakeup(), or __toString() to trigger arbitrary file creation, code execution, or memory corruption. Because the initial upload progress ingestion occurs before authentication middleware executes, any public upload endpoint on an affected system serves as a viable remote entry vector.

An essential and often misunderstood aspect of this vulnerability concerns the cleanup lifecycle governed by session.upload_progress.cleanup. Upstream documentation states that upload progress metadata is purged immediately once the file upload completes. However, in real-world exploitation scenarios, an attacker can stream an exceptionally large file or artificially throttle TCP throughput, ensuring that the upload progress data remains active inside the session buffer precisely when user-space code executes session_start(). The deserialization exploit executes synchronously in the thread context, completing code execution long before cleanup routines can engage.

Persistent worker contamination and the PHP-FPM execution model

The architectural risk of CVE-2026-115560 is dramatically amplified by modern PHP deployment models. In high-performance enterprise architectures, PHP does not execute as an isolated, short-lived CGI process that terminates after every HTTP request. Instead, environments deploy FastCGI Process Manager (PHP-FPM) worker pools or persistent multi-threaded modules such as Apache mod_php or Swoole coroutine engines.

In these persistent process models, worker processes are reused across thousands of successive HTTP requests to eliminate the overhead of process spawning and framework bootstrapping. While PHP's Zend Engine executes a request shutdown phase (php_rshutdown) designed to reset global state variables and deallocate request memory, session serialization settings modified via ini_set() during incomplete request lifecycles can result in configuration drift.

In multi-tenant shared hosting platforms or microservice gateways hosting multiple virtual hosts under shared worker pools, if one tenant application modifies session.serialize_handler and subsequently crashes or aborts execution abnormally, subsequent incoming requests assigned to that identical worker process inherit the corrupted serialization state. An external adversary can deliberately induce worker timeouts or memory limit crashes to establish persistent desynchronization, turning otherwise invulnerable applications into active exploitation targets.

Epistemic audit: Stated vendor assumptions versus unstated operational reality

A rigorous technical critique reveals substantial discrepancies between the vendor's risk justification and the reality of enterprise infrastructure deployments:

Table 2: Epistemic evaluation of vendor risk framing versus operational deployment realities.

Investigative Dimension	Stated by Vendor / Advisory	Observed Reality / Unstated Realities	Technical and Evidentiary Basis
Practical Attack Likelihood	Classified as very unlikely in real-world applications.	Widely prevalent in legacy enterprise frameworks and custom CMS integrations.	Dynamic runtime switching of session handlers is a standard design pattern when bridging modern Laravel or Symfony components with legacy codebases.
Remediation Protocol	Informational advisory; no out-of-band binary patch required.	Leaves default-installed systems exposed to opportunistic exploitation.	Standard Linux distribution package managers (apt, dnf, yum) do not alter configuration files during minor updates, leaving default settings active.
Shared Hosting Isolation	Assumes application code execution boundaries remain strictly isolated.	Persistent worker contamination across shared PHP-FPM pools.	In multi-tenant hosting environments, custom ini_set directives executed in one virtual host can contaminate shared worker process memory states.
Upstream Disclosure Timing	Presented as an independent, isolated configuration curiosity.	Direct consequence of intense red-team scrutiny following the PHP2Shell leak.	Independent vulnerability researchers uncovered the vector while auditing ext/session cleanup routines in the wake of CVE-2026-109618.
Authentication Requirement	Implicitly treated as requiring deep application access.	Fully unauthenticated pre-session remote trigger.	The RFC1867 upload progress hook executes during multipart header parsing, completely bypassing application authentication barriers.

UK regulatory framework, Cyber Essentials compliance, and governance mandates

The disclosure of CVE-2026-115560 carries severe compliance implications for UK organisations operating under the Cyber Essentials framework and critical national infrastructure cybersecurity regulations. Under UK Cyber Essentials v3.3, organisations must apply fixes to all critical and high-severity vulnerabilities within 14 calendar days of public release. Because the PHP Foundation has chosen not to release a binary software patch immediately, compliance auditors face an unprecedented ambiguity: Does an informational advisory with a documented configuration workaround satisfy the remediation mandate?

The National Cyber Security Centre (NCSC) Vulnerability Management Guidance explicitly states that where vendor software updates are unavailable, mandatory risk mitigation requires the immediate implementation of documented compensating controls. Consequently, UK enterprises that fail to disable session.upload_progress.enabled by 6 November 2026 (representing exactly 14 days from the 23 October disclosure, derived) will fall into non-compliance with Cyber Essentials certification criteria.

Furthermore, because successful exploitation of CVE-2026-115560 allows unauthenticated remote attackers to execute arbitrary system commands under the web server identity (typically www-data or nginx), an intruder can readily access database credentials stored in wp-config.php, .env files, or backend SQL connection pools. Under Article 32 of the UK General Data Protection Regulation (UK GDPR) and Section 61 of the Data Protection Act 2018, failure to secure server runtimes against known remote execution flaws constitutes an operational failure to implement appropriate technical measures, creating strict liability for ensuing data breach disclosures.

Defensive engineering playbook and operational verification

Enterprise infrastructure teams must execute a five-point hardening protocol across all web clusters hosting PHP services:

1. Disable Upload Progress Globally: Open the primary php.ini configuration file across all server nodes and enforce session.upload_progress.enabled = 0. Verify that this directive is explicitly set in both CLI and PHP-FPM configuration trees (for example, /etc/php/8.x/fpm/php.ini and /etc/php/8.x/cli/php.ini). Reload the PHP-FPM daemon via systemctl reload php-fpm to apply changes instantly without dropping active TCP connections.

2. Lock Down PHP-FPM Pool Configurations: Prevent individual tenant virtual hosts or scripts from overriding session serialization directives. In pool configuration files (/etc/php/8.x/fpm/pool.d/www.conf), define php_admin_flag[session.upload_progress.enabled] = off and php_admin_value[session.serialize_handler] = php. Directives declared via php_admin cannot be overwritten by user scripts calling ini_set().

3. Static Codebase Auditing for Dynamic Handler Switches: Execute static analysis across all deployed codebases and third-party vendor plugins using ripgrep or automated SAST scanners. Flag any instances of ini_set('session.serialize_handler', ...) or ini_set("session.serialize_handler", ...). Any application requiring dynamic serialization formats must be refactored to use explicit helper serialization libraries rather than mutating runtime engine state.

4. Web Application Firewall (WAF) Rule Deployment: At the reverse proxy layer (Cloudflare, AWS WAF, or Nginx ModSecurity), deploy inspection rules to intercept multipart POST requests containing the PHP_SESSION_UPLOAD_PROGRESS parameter. If the parameter contains special characters such as vertical pipes (|), semicolons, or serialized class prefixes (O: or a:), immediately drop the connection with an HTTP 403 Forbidden status.

5. Verify Runtime Hardening with Automated CLI Inspection: Run automated validation across production fleets using the command php -r 'echo ini_get("session.upload_progress.enabled");'. Confirm that the return value is 0 or empty across every container instance, confirming that the attack surface is completely eliminated ahead of the scheduled monthly vendor release.