Another PHP issue identified while vendors report affected products

Reports of exploitation attempts and large-scale scanning targeting PHP2Shell (CVE-2026-109618 and CVE-2026-109619) continue to increase, but researchers report that reliable exploitation appears dependent on specific deployment conditions and more complex than some early reporting suggested.

Reports of exploitation attempts and large-scale scanning targeting PHP2Shell (CVE-2026-109618 and CVE-2026-109619) continue to increase, but researchers report that reliable exploitation appears dependent on specific deployment conditions and more complex than some early reporting suggested.

Vendor investigations have shown that exposure extends beyond standalone PHP web servers to products that embed PHP, including appliances, management platforms, security products, and cloud services. The Dutch National Cyber Security Centre (NCSC-NL) currently tracks hundreds of affected and under-investigation products.

Vendor investigations have shown that exposure extends beyond standalone PHP web servers to products that embed PHP, including appliances, management platforms, security products, and cloud services. The Dutch National Cyber Security Centre (NCSC-NL) currently tracks hundreds of affected and under-investigation products.

On October 23, 2026, PHP disclosed CVE-2026-115560, a separate vulnerability affecting applications that use a specific and uncommon session configuration. The issue is distinct from PHP2Shell and is not addressed by the October 21 emergency updates.

On October 23, 2026, PHP disclosed CVE-2026-115560, a separate vulnerability affecting applications that use a specific and uncommon session configuration. The issue is distinct from PHP2Shell and is not addressed by the October 21 emergency updates.

On October 23, 2026, PHP disclosed CVE-2026-115560 , a vulnerability that affects applications using a specific and uncommon session-handling configuration. Exploitation requires an application to modify session.serialize_handler at runtime before calling session_start() while session upload progress remains enabled.

Because these conditions are uncommon, PHP has not issued an emergency release, assigned a CVSS score, or published a complete affected-version range. Instead, there are plans to address the issue in a future routine release.

Unlike PHP2Shell (CVE-2026-109618 and CVE-2026-109619), PHP does not describe CVE-2026-115560 as affecting all PHP deployments serving web requests. The advisory has drawn attention because it recommends the same interim mitigation already published for CVE-2026-109619: disabling session.upload_progress.enabled. While this has led to questions whether the PHP2Shell fixes were incomplete, PHP has described CVE-2026-115560 as a separate issue with different exploitation requirements and remediation guidance.

Since the release of emergency updates for PHP2Shell, multiple organizations have reported exploitation attempts and large-scale scanning activity targeting the two flaws involved.

At the same time, researchers have cautioned that many publicly circulating proof-of-concept exploits do not accurately represent the vulnerabilities. Several researchers report that some publicly shared exploits are based on older "session poisoning" techniques used against local file inclusion vulnerabilities in PHP applications rather than the PHP2Shell vulnerabilities themselves.

Current reporting suggests exploitation is more deployment-dependent than initially thought. Researchers report that successful exploitation depends on factors such as the PHP version, operating system, web server, worker configuration, and memory layout. While exploitation attempts are widespread, public reporting continues to distinguish between scanning activity and successful compromise, and evidence of large-scale successful exploitation remains limited.

Early reporting focused on PHP web servers because the vulnerabilities reside in the PHP runtime rather than a specific application. Subsequent vendor assessments have shown that exposure extends beyond standalone PHP installations to products that embed or depend on PHP, including appliances, management platforms, security products, and cloud services.

The Dutch National Cyber Security Centre (NCSC-NL) maintains a public inventory of affected products, fixes, and vendor investigations. As of October 23, the inventory listed:

224 products as vulnerable

224 products as vulnerable

394 under investigation

394 under investigation

Confirmed affected products include offerings from Palo Alto Networks, Citrix, F5, Cisco, HPE, NetApp, QNAP, and Trend Micro.

Several vendors have already released fixes or mitigation guidance, including Broadcom for Symantec Endpoint Protection Manager, Synology for supported PHP packages, and Google for PHP-based cloud workloads that require rebuilding and redeployment.

The inventory also includes widely deployed applications such as WordPress, Drupal, Joomla, Magento, Moodle, Nextcloud, Zabbix, and phpMyAdmin, which inherit exposure when deployed on vulnerable PHP versions.

Recent reporting reinforces that PHP2Shell is a critical risk for which working exploits exist, but exploitation does not appear universally reliable across all affected environments. Researchers have observed large-scale scanning and exploitation attempts, while noting that successful exploitation depends on deployment-specific conditions and that public exploit code does not consistently achieve code execution.

The growing list of affected products highlights that PHP2Shell is increasingly a supply-chain and embedded-component issue rather than solely a PHP server patching problem. Organizations may have exposure through appliances, management interfaces, security products, cloud services, and business applications that embed PHP internally, making vendor guidance and product-specific updates critical.

The key takeaway remains unchanged: exploitation attempts are occurring, public exploit code is available, and patching remains urgent. However, widespread scanning should not be mistaken for widespread successful compromise.

Organizations should continue prioritizing updates, monitoring vendor advisories, and reviewing internet-facing systems and embedded PHP components for exposure.

Upgrade PHP deployments to:

Applying the updated runtime removes exposure to CVE-2026-109618 and CVE-2026-109619. Continue monitoring vendor advisories for products and appliances that bundle PHP internally.

Disable session.upload_progress.enabled and restart PHP workers where direct control of the PHP runtime is available. PHP recommends this setting as a temporary mitigation for CVE-2026-109619 and as interim protection for CVE-2026-115560. Organizations using managed hosting, SaaS platforms, or products that embed PHP may not be able to apply this setting directly and should instead follow guidance from their hosting provider or product vendor. PHP notes that these measures reduce exposure to documented attack paths but do not replace security updates.

Identify applications, appliances, security products, and management platforms that include PHP components. Review vendor guidance for confirmed affected products and products still under investigation using the NCSC-NL inventory and vendor advisories.

Review internally developed PHP applications for code that changes session.serialize_handler from php_binary or php_serialize to php using ini_set() before calling session_start(). PHP identified this configuration as a prerequisite for exploitation of CVE-2026-115560

Monitor web server, application, endpoint, and network telemetry for exploitation attempts and post-compromise activity, including unusual upload activity, requests containing PHP_SESSION_UPLOAD_PROGRESS, unexpected process execution from PHP worker processes, and web shell deployment. Consider reviewing logs dating back to October 17, 2026, the earliest publicly reported exploitation attempt.