---
title: New PHP Security Vulnerability Identified Without Immediate Patch
url: https://www.dataloco.com/en/new-php-security-vulnerability-identified-without-immediate-patch
published: 2026-10-27T13:23:17+00:00
language: en
section: Security
source: https://shiftdelete.net/php-yeni-guvenlik-acigi-cve-2026-115560
organizations: PHP, Cloudflare
publisher: Dataloco
---

# New PHP Security Vulnerability Identified Without Immediate Patch

A new security vulnerability has been detected in PHP, identified as CVE-2026-115560. This flaw carries a risk of remote code execution and affects web applications with specific session configurations.

According to an official announcement released by the PHP team on October 23, 2026, the risk exists within the session mechanism that tracks the progress of file uploads. The PHP team plans to address the issue in the next regular bug fix release rather than through an emergency update, as the vulnerability requires an unusual application configuration to be exploited.

To trigger the flaw, several conditions must occur simultaneously. The session.serialize_handler configuration must be set to either php_binary or php_serialize. Additionally, the application must use the ini_set() function to change this value to php before the session_start() call is made. The session.upload_progress.enabled feature, which is active by default, must also be enabled.

PHP developers stated that systems that do not change the session serialization method during runtime are not affected. As a temporary measure, it is recommended to set session.upload_progress.enabled=0 in the PHP configuration to disable the session feature that tracks file upload progress.

This vulnerability is distinct from two previous critical issues, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, which emerged on October 21. Those previous flaws allowed remote code execution without authentication, leading PHP to quickly release versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, these updates do not fix CVE-2026-115560.

Cloudflare announced on October 23 that its current web application firewall rules block known attack attempts targeting the new vulnerability, provided the applications use the default PHP file upload progress field name. While previous vulnerabilities were linked to attempts to install Potassium malware from the Mirai botnet family, there are no verified findings of successful remote code execution through those flaws, nor are there reports of CVE-2026-115560 being used in active attacks.

## This story in other languages

- [हिन्दी](https://www.dataloco.com/hi/php-ma-naii-sarakashha-khama-ka-pata-cal-paca-abha-upalbthha-naha)
- [Deutsch](https://www.dataloco.com/de/kritische-php-schwachstelle-cve-2026-115560-ohne-vorlaufiges-sicherheitsupdate)
- [Español](https://www.dataloco.com/es/nuevo-agujero-de-seguridad-en-php-detectado-sin-parche-disponible-aun)
- [Italiano](https://www.dataloco.com/it/nuova-vulnerabilita-php-senza-patch-immediata-espone-al-rischio-di-esecuzione-remota-di-codice)
- [Nederlands](https://www.dataloco.com/nl/nieuwe-php-beveiligingslek-zonder-onmiddellijke-correctie)
- [Svenska](https://www.dataloco.com/sv/php-sakerhetsbrist-utan-tillfallig-losning)