Wire · regulatory
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
◆ Sectors
◆ Source
◆ Verified
Fusion42 · 23 October 2026 · Fusion42 review
PHP has warned of a new remote code execution vulnerability (CVE-2026-115560) that affects only web applications with a rare specific configuration involving session serialize handler changes during runtime. PHP recommends turning off session upload progress until a fix is included in the next routine bugfix release, following emergency patches for prior critical PHP2Shell flaws.
This Wire brief sits within Fusion42's coverage of Enterprise Software and Cybersecurity, and 4 sources have reported it between 21 Oct 2026 and 23 Oct 2026.
◆ ◆ The Wire takeaway
You must disable PHP's session upload progress to avoid the new RCE risk until the next update arrives. This vulnerability puts your server at risk only if you change session handlers mid-run, so patch or configuration changes can keep you safe right now.
◆ Coverage
4 sources · first reported 21 Oct 2026 · latest 23 Oct 2026
◆ Related on Wire
◆ Topics