PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
Summary: PHP published an informational advisory on October 23 warning of CVE-2026-115560, a new remote code execution path that affects only applications that set session.serialize_handler to php_binary or php_serialize, switch it to php via ini_set() at runtime, and do so before calling session_start(), with session upload progress still enabled. PHP rates the setup unlikely in practice, is not issuing an emergency fix, and recommends setting session.upload_progress.enabled=0 until the next routine release, the same mitigation it listed on October 21 for CVE-2026-109619.
Bottom line: The October 21 PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) drew exploit attempts that Cloudflare says rose from tens of thousands within 45 minutes of disclosure to millions by early October 22, with Amazon honeypots logging attempts on October 17, four days before disclosure - so the window between a PHP flaw and mass scanning is now measured in hours, not weeks.