The PHP security team has published mitigation guidance for a new remote code execution vulnerability that currently has no patch, warning it affects systems running a specific, non-default configuration.

The flaw, tracked as CVE-2026-115560, was disclosed in a Friday advisory. PHP is used by nearly 70% of websites on the Internet, and VirusTotal estimates put the number of exposed PHP hosts online at more than 5.1 million, with roughly 3.8 million reachable on at least one open port.

According to PHP’s advisory, exploitation requires an unusual combination of settings and application behavior: an application must set session.serialize_handler to php_binary or php_serialize, then switch it to php at runtime using ini_set() before calling session_start(), with session upload progress still enabled.

Because this setup is considered unlikely in real-world deployments, the PHP team said it will address CVE-2026-115560 in the regular release cycle rather than issue an emergency patch, with a full advisory to follow in the next release.

Recommended mitigation

  • Set session.upload_progress.enabled=0 until a patch is available
  • Admins who already applied this setting as part of earlier guidance do not need to take further action

This mitigation should already have been in place since Wednesday, when PHP patched two separate critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.

PHP2Shell now under active attack

The PHP2Shell patches came one day after PHP urged administrators to prepare for emergency updates. Some proof-of-concept code circulated before the fixes shipped, but PHP said none of it was functional.

Despite that, multiple security firms, including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack, observed unsuccessful exploitation attempts before public disclosure, after details including the CVE IDs and mitigation advice given to some critical infrastructure providers leaked online. Amazon’s threat intelligence team said attackers began targeting the flaws four days before patches were released.

AWS CISO CJ Moses said payloads and anonymization infrastructure varied across attempts, suggesting multiple actors, and that it remains unclear whether any attempts would succeed against real systems. Dataminr’s TRACE team similarly reported that observed activity has been limited to scanning, fingerprinting, and non-working exploits, with no confirmed compromises, but cautioned that working exploits or successful attacks could emerge soon.