CVE-2026-115560

PHPから新たな脆弱性CVE-2026-115560が発表されました。21日発表の脆弱性CVE-2026-109619より限定的で緊急パッチは出ず、次回リリースまで暫定処置として session.upload_progress.enabled = 0 のままにしておくことが推奨。 https://t.co/Z3yrqeMEqw

【10/23公表】PHPに新たな脆弱性CVE-2026-115560。21日の緊急修正版にも影響し、特定の設定条件で遠隔コード実行の恐れ。開発元は次回修正版までsession.upload_progress.enabled=0を推奨。悪用被害は未確認。

PHP shares mitigation for new RCE vulnerability with no patch https://t.co/g5NuhTEfwb "According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems "with an unusual combination of configuration and application code."

New on 23 Oct: CVE-2026-115560 is not fixed by these patches. Interim mitigation is session.upload_progress.enabled=0. Then watch for PHP workers starting shells or downloading tools.

@Barnacules Do you still use Unraid? Unraid uses PHP for it's webgui. You should upgrade to Unraid 7.3.4 which has the patches for the 2 CVEs that were published Wednesday. Then you should modify /boot/config/go to add the mitigation for PHP CVE-2026-115560. https://t.co/LhIQckQrvP

PHP disclosed a new unpatched RCE flaw today, CVE-2026-115560. It only hits an unusual setup: session serializer switched to 'php' at runtime with session upload progress on. Mitigation: set session.upload_progress.enabled=0. A fix comes in PHP's next regular release.

Baru saja update PHP2Shell, ternyata PHP mengumumkan risiko RCE lain (CVE-2026-115560) yang tidak tertutup oleh 8.5.12/8.4.27/8.3.36/8.2.35. Jadi patch kemarin belum cukup. Inventaris server PHP Anda, pantau advisory resminya, dan perketat WAF serta monitoring sambil menunggu patch.

⚠️ PHP, CLOUDFLARE Y #LaLigaGate (2/2) Si aún tienes una versión vulnerable de PHP y dependes del WAF de Cloudflare, pasar a «Solo DNS» elimina una barrera de seguridad justo cuando más falta hace. Y ojo: que tu web esté bloqueada desde determinadas conexiones españolas NO significa que esté proteg…

@markgadala PHP’s official mitigation is to set session.upload_progress.enabled=0 in php.ini or your PHP-FPM pool configuration, then restart all PHP workers. PHP confirms this blocks the CVE-2026-115560 vector while awaiting the patch. Keep PHP updated too. https://t.co/KZlx9hTr3I

Patched PHP2Shell, then turned upload progress back on? PHP disclosed another RCE, CVE-2026-115560, unpatched until the next release. Only rare configs are hit, but the fix is easy: session.upload_progress.enabled=0 Still using it? #PHP Source: https://t.co/X6BvDUwuXL

ivst/CVE-2026-115560: CVE-2026-115560: PHP session upload progress mitigation

CyberRick-AI/php2shell-check: Passive, self-hosted PHP vulnerability exposure scanner (PHP2Shell CVE-2026-109618/109619, CVE-2026-115560) with a plain-English patch report. PWA, CLI, Docker. Zero dependencies.

slabbdev/php-cve-115560-kit: Local-only PoC lab for CVE-2026-115560 (PHP session upload-progress serialize-handler confusion) — two-request PoC on the PHP CLI built-in server (no Docker) + fleet audit implementing the advisory's decision tree.

Nguemoue/project2026_20261023_php_rce_guard: Vérifie si une version PHP est encore exposée aux RCE du 21 octobre 2026 (CVE-2026-109618, CVE-2026-109619) et rappelle le suivi CVE-2026-115560.

basesixtythree/B63-POC-CVE-2026-115560: PoC and verification material for CVE-2026-115560 (PHP session serializer confusion via session.upload_progress - object injection - RCE)

GitHub cross-source: sykeops/CVE-2026-115560: PHP Session upload progress injection - CVE-2026-115560

GitHub cross-source: prnjlksingh/php-cve-2026-115560-demo:

GitHub cross-source: murrez/php2shell: php2shell: Advanced hybrid exploit framework for CVE-2026-109618, CVE-2026-109619 & CVE-2026-115560. Features Auto-LFI parameter discovery, SAPI profiling, OOM fuzzing calibration, and FPM worker pinning. Stdlib only.

GitHub cross-source: PasqualePillitteri/php2shell-hardening: Mitigations for PHP installs that cannot update yet: CVE-2026-109618 / CVE-2026-109619 (php2shell) and CVE-2026-115560. Edge rules, auth before PHP, request limits, PHP settings. Unofficial. The real fix is updating PHP.

GitHub cross-source: syhunt/php2shell-protection: Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance