Affected Systems

PHP web applications with specific configuration: session.serialize_handler set to php_binary or php_serialize, then changed to php via ini_set() before session_start(), with session upload progress enabled. Affected PHP versions not disclosed; likely all current branches (8.2.x, 8.3.x, 8.4.x, 8.5.x).

Exploitation Status

No active exploitation reported. CVE-2026-115560 is not being targeted in the wild. Separate PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) are under active attack but were patched October 21.

Business Impact

Risk limited to web applications with unusual session handler reconfiguration patterns. PHP considers this an unlikely scenario and is not issuing emergency patches. No CVSS score published. Organizations that already disabled session.upload_progress.enabled=0 as mitigation for CVE-2026-109619 are already protected. Fix will be included in next routine PHP release cycle.

Urgency

🟡 Within a week

Recommended Actions

  • Set session.upload_progress.enabled=0 in php.ini or web server configuration for all PHP installations until patched versions are released
  • Audit PHP applications to identify any that dynamically change session.serialize_handler via ini_set() before session_start() calls
  • Prioritize patching PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address actively exploited PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
  • Monitor PHP project announcements for routine release containing CVE-2026-115560 fix and full advisory
  • Review web application firewall and intrusion detection logs for anomalous session handling or upload activity