CVE-2026-115560

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws. New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance. Full details → https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

⚠️ Another PHP RCE Vulnerability Disclosed - CVE-2026-115560 Just two days after the critical PHP security releases, the PHP security team has disclosed another potential Remote Code Execution (RCE) vulnerability.

これの件か（CVE-2026-115560）。 php.ini などの設定で、session.serialize_handler を php_binary か php_serialize していて、アプリのコードがsession_start() の前に ini_set() で実行時に php へ切り替えている場合は、次のリリースが出るまで session.upload_progress.enabled=0 にしておくべき…… 誰がこんな条件に当てはまるんや https://www.php.net/archive/2026.php#2026-10-23-1

PHP2Shell update: PHP published an advisory for a related flaw, CVE-2026-115560, and suggests every server set session.upload_progress.enabled=0 until the next regular release, even if patched. What changed: https://www.zerospam.org/php2shell-php-vulnerability-live-updates/?utm_source=x&utm_medium=social&utm_campaign=threat-intel-log