phpnews.net New PHP Vulnerability CVE-2026-115560 Poses Low Risk of RCE
Article Content
- •CVE-2026-115560 poses a low risk of RCE under specific configurations.
- •PHP advises disabling 'session.upload_progress' until a fix is available.
- •No confirmed exploitation of the vulnerability has been reported.
On October 24, 2026, PHP announced a new security vulnerability, CVE-2026-115560, which could allow remote code execution (RCE) under specific configurations. The vulnerability affects web applications that set 'session.serialize_handler' to either 'php_binary' or 'php_serialize' and then switch it to 'php' at runtime before calling 'session_start()'. PHP recommends disabling the 'session upload progress' feature by setting 'session.upload_progress.enabled=0' until a fix is released. This mitigation was previously suggested in an advisory for CVE-2026-109619, published on October 21, 2026. Currently, there are no reports of exploitation, and PHP has stated that the risk is low in practice due to the unusual configuration required. The PHP security team is addressing this issue in their regular release cycle rather than issuing an emergency update.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Mirai, Amazon and CVE-2026-109619 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What configurations are affected by CVE-2026-115560?
Is there an active exploit for this vulnerability?
What should I do to protect my application?
Continue Reading
Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both… 
Cling Botnet Exploits Realtek SDK Flaw Using STUN Traffic for C2 The Cling botnet has been identified as exploiting a critical vulnerability (CVE-2021-35394) in the Realtek Jungle SDK, allowing attackers to deploy malware that disguises command-and-control (C2) traffic as legitimate STUN protocol exchanges. This vulnerability, which has a CVSS score of 9.8, was first exploited…