Another Remote Code Execution Flaw Found in PHP; South Korea's KISA Urges Emergency ...

A remote code execution (RCE) flaw that could lead to full server compromise has been identified in PHP, the programming language widely used for website development. With no official security patch yet released, the Korea Internet & Security Agency (KISA) has issued an urgent recommendation for a temporary workaround involving server configuration changes.

According to a security advisory KISA published on the 24th, The PHP Group, the organization behind PHP development, released an interim mitigation for the new vulnerability (CVE-2026-115560) the day, the 23rd. The flaw arises in the process by which PHP handles session information used to maintain a user's connection state. If exploited by an external attacker, it could allow arbitrary commands to be issued to the server or programs to be executed, potentially leading to further damage such as leakage of internal information or execution of malware.

However, the number of servers actually exposed to the risk is limited. The PHP developers explained that the weakness is opened only when a specific server configuration and program execution condition are met simultaneously. Specifically, a setting that changes the way a website stores user session information during program execution must be enabled alongside the file upload progress management feature. The developers assessed that this combination is rare in typical operating environments, so the likelihood of real-world exploitation is low.

The problem is that existing updates cannot block this flaw. The developers have not even disclosed the affected versions or the fixed versions, stating only that a formal patch will be provided in the regular update. Accordingly, KISA recommended disabling the feature that contributes to triggering the vulnerability until a patch is released. Server administrators can set the file upload progress management feature (session.upload_progress.enabled) to '0' in the PHP configuration file php.ini or in the PHP-FPM configuration. After changing the setting, all PHP worker processes must be restarted for the measure to actually take effect.

This advisory is also included in the interim mitigation for a separate vulnerability (CVE-2026-109619) disclosed on the 21st of this month. If the same feature was already disabled at that time, no additional action is needed.

Key details of the vulnerability are as follows.

Note: CVE-2026-109619, disclosed on the 21st of this month, includes the same interim measure.

The PHP developers said, "This issue occurs only in a combination of non-standard server configuration and program code," and "we recommend disabling the file upload progress management feature until the regular update is distributed." KISA also urged maintaining the blocking configuration until a formal patch is available and continuing to monitor for signs of cyber intrusions.

Because PHP is used as the backend for many web services, including content management systems and e-commerce platforms, companies and institutions using this configuration must accept the risk of their servers being exposed externally during the patch gap. In particular, services that have customized both session handling and file upload features should prioritize reviewing their settings. Security experts recommend applying the official patch as soon as it is released and, until then, closely monitoring for abnormal process execution or access logs to upload paths.