PHP shares mitigation for new RCE vulnerability with no patch

The PHP security team has issued an advisory providing mitigation measures for an unpatched remote code execution vulnerability tracked as CVE-2026-115560. As outlined in BleepingComputer's report, the security flaw affects installations configured with non-default runtime settings. The announcement follows Wednesday emergency patches for two critical vulnerabilities known as PHP2Shell.

This briefing details the precise configuration chain required to trigger the flaw, the directive administrators must disable, and active scanning activity targeting the ecosystem. It is intended for systems administrators, DevOps engineers, and security teams responsible for hardening public-facing PHP infrastructure across enterprise networks.

What broke in PHP shares mitigation for new RCE

The breakdown occurs because of an unsafe interaction between serialization routines during session handling when an application changes its parsing rules dynamically. Under vulnerable conditions, an environment sets session.serialize_handler to php_binary or php_serialize in its server configuration and subsequently switches it to standard php at runtime using ini_set before invoking session_start. When combined with active session upload progress, this sudden runtime shift desynchronizes internal parsing logic. The interpreter misinterprets incoming structured data, creating an exploitable condition where remote attackers can achieve arbitrary code execution.

This issue emerged immediately after the PHP development team released emergency updates on Wednesday for two related critical flaws, CVE-2026-109618 and CVE-2026-109619, collectively designated as PHP2Shell. Maintainers had alerted administrators one day prior to prepare for incoming patches. During that deployment window, engineers recognized that the upload progress mitigation applied against PHP2Shell was also required to neutralize CVE-2026-115560. Rather than releasing another emergency out-of-band fix, maintainers chose to address this newer vulnerability in their regular scheduled release cycle and publish a full advisory later.

Who is exposed by PHP shares mitigation for new RCE

Exposure to this security flaw requires an unusual combination of system configuration parameters and specific application code behaviors. Target systems must explicitly define session.serialize_handler as php_binary or php_serialize in baseline configuration files, while running application scripts must execute ini_set to reset that value to php before calling session_start. Additionally, session upload progress tracking must remain active. Applications that rely on default settings or never modify their serialize handlers during runtime execution do not satisfy the vulnerability chain and are not exposed to exploitation.

The broader exposure profile is substantial given the vast global footprint of the underlying technology across modern web hosting infrastructure. PHP powers nearly 70% of all websites on the Internet, establishing a massive operational baseline worldwide. VirusTotal telemetry estimates that more than 5.1 million PHP hosts are directly reachable across the public web, with roughly 3.8 million systems presenting at least one open port to incoming internet traffic. Any reachable server that implements this non-default configuration pattern faces potential exploitation attempts against its open network ports.

What to do now about PHP shares mitigation for new RCE

Administrators must apply the interim mitigation advised by the project maintainers until an official security release becomes available. The primary remediation requires configuring session.upload_progress.enabled=0 within the active php.ini files across all web servers. The security team noted that organizations that applied this directive on Wednesday prior to patching the two PHP2Shell vulnerabilities should keep it in place, confirming that no further action is needed. Leaving this configuration flag disabled effectively closes the exploit pathway by preventing upload progress tracking from processing input.

Engineering teams should also audit custom application source code to evaluate their handling of session variables and serialization settings. Programs that never alter their serialize handler dynamically at runtime can safely keep the session upload progress feature enabled if business functionality requires it. However, reviewing code for runtime ini_set modifications targeting session.serialize_handler ensures no hidden dependencies violate safe operational boundaries. Organizations should maintain the disabled upload progress setting until the PHP team releases its upcoming regular update, which will provide a permanent code patch alongside a full technical advisory.

How the PHP shares mitigation for new RCE issue works

The technical mechanics of the flaw depend on how the interpreter handles session data structures when conflicting serialization engines operate during a single script run. An application starts with either php_binary or php_serialize configured as its base handler, preparing memory structures for that format. When code invokes ini_set to reconfigure the handler to php immediately prior to session_start, the parsing environment becomes conflicted. The deserialization mechanism misaligns input boundaries during session reconstruction, creating memory confusion that attackers can leverage to craft malicious data payloads that trigger arbitrary code execution.

The session upload progress mechanism provides the delivery vector that makes this memory confusion reachable from unauthenticated requests. When active, this feature automatically intercepts file upload streams and records progress metrics into the active session array. Threat actors can introduce controlled data into the session storage by sending specially formatted upload parameters without authenticating to the web application. Because the engine subsequently processes these injected progress attributes using the mismatched serialization routines, the payload triggers arbitrary execution. Disabling upload progress prevents the automatic injection, neutralizing the attack chain entirely.

What is still unknown about PHP shares mitigation for new RCE

Several operational details regarding CVE-2026-115560 remain unconfirmed by the core development group. Maintainers have not published specific version timelines or confirmed dates for the upcoming regular release that will bundle the official code fix. While the team indicated that a full advisory will accompany that future release, the exact internal engine patch remains undisclosed. In addition, no functional proof-of-concept exploits have appeared publicly for this vulnerability. Because practical exploitation demands an unusual configuration sequence, maintainers consider the real-world risk lower than that of standard RCE bugs.

Broader uncertainty surrounds active exploitation trends across the ecosystem following the recent disclosure of PHP2Shell. Security vendors including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack detected unsuccessful attacks after details leaked prior to public disclosure. Amazon Threat Intelligence observed targeting beginning four days before Wednesday patches, with AWS chief information security officer CJ Moses noting that payloads and anonymization infrastructure varied across multiple actors. Dataminr TRACE reported activity remains restricted to scanning and non-working exploits with no known compromises, though The Blue Report 2026 highlights that defenses block only 37% of actions once attackers secure credentials across 338 million simulations.