PHP shares mitigation for new RCE vulnerability with no patch

The PHP development team has publicly shared temporary mitigation steps for a newly identified remote code execution vulnerability tracked as CVE-2026-115560. Arriving immediately on the heels of major emergency updates for two other critical engine flaws, this unpatched vulnerability affects web servers running non-default configuration settings and allows remote attackers to execute arbitrary commands if specific runtime conditions are met.

Technical Overview of CVE-2026-115560

According to technical advisories issued by the PHP security team, the vulnerability exists within the interaction between PHP's session initialization and runtime configuration routines.

Exploitation relies on a very specific set of conditions: An application must configure session.serialize_handler to php_binary or php_serialize within its configuration files, and then dynamically switch that handler back to php at runtime using ini_set() prior to invoking session_start(). Furthermore, session upload progress monitoring must remain active. When these conditions align, malicious actors can leverage improper state handling during session uploads to achieve arbitrary remote code execution on the server.

Impact and Preconditions

While the vulnerability carries severe consequences, security researchers note that the required configuration sequence is relatively rare in standard web applications.

Because the flaw requires a specific runtime change of the serialization handler combined with active session upload features, default installations that never modify the serialization handler at runtime remain unexposed. The PHP team elected to process CVE-2026-115560 through the standard bug-fix cycle and plans to release a complete software patch in the upcoming point updates across supported branches.

Required Mitigation Action for Server Administrators

Until the official software patch is distributed in the next scheduled release, system administrators and web host operators can eliminate the attack vector by disabling session upload progress globally.

Administrators should set session.upload_progress.enabled = 0 in their main php.ini configuration, FPM pool settings, or web server configuration files, followed by a full service restart of all web workers. Because this configuration change was also recommended as a temporary control for earlier PHP vulnerabilities, servers that previously applied this setting are already protected against CVE-2026-115560 and require no further adjustments.