PHP’s Second Unpatched RCE Risk: What to Check on Your Server

Key Takeaway

• PHP’s second unpatched RCE carries a CVE number: CVE-2026-115560 was disclosed on October 23, 2026, two days after the emergency PHP2Shell patches, and PHP has decided it needs no emergency fix because the vulnerable setup is rare.
• One setting covers both: session.upload_progress.enabled=0 blocks the new risk and was already the mitigation for CVE-2026-109619, so anyone who applied it on October 21 is already covered.
• The patched pair still drives the attack wave: exploit attempts against CVE-2026-109618 and CVE-2026-109619 reached millions within a day of disclosure, but public exploits need extra weaknesses on the target, and no confirmed takeover has been reported.
• Version check beats panic: the fix line is clear, PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, and older branches have backported packages. The commands to verify yours are below.
• Do not take the site offline: the precautionary shutdowns were unnecessary; a version check, one setting, and an update cover every recorded threat.

PHP has disclosed a second unpatched RCE in the same week it patched the PHP2Shell pair, and the practical question for every server owner has changed shape: not when the next patch lands, but what to check on your server tonight.

The new issue, assigned CVE-2026-115560, arrived in an informational advisory on php.net dated October 23, 2026. It affects only applications configured in an unusual way, and PHP has assigned it to the regular release cycle instead of an emergency patch, promising a full advisory with the next routine release. The project has not listed affected versions, published a severity score, or said whether it shares a root cause with the earlier flaw.

The timing matters more than the rarity. It landed two days after the October 21 emergency release that fixed the PHP2Shell flaws, and it arrives while exploit attempts against those patched flaws run in the millions. One more disclosure line, however narrow, lands on servers that are already mid-patch.

What the Second Unpatched RCE Actually Requires

The risk is real but narrow, and the four conditions together define who needs to act today.

PHP describes a setup where a web application does all of the following: sets the session.serialize_handler option to php_binary or php_serialize in its configuration, changes that option to “php” while the application runs by calling ini_set(), makes that change before it calls session_start(), and still has session upload progress enabled. PHP’s own assessment: this setup is unlikely in practice.

That last piece matters because session upload progress is on by default. It exists to let an application track how far a file upload has progressed, and most applications never touch it or the serialize handler at all. A framework or application that never changes the serialize handler while running is not exposed through this path.

The action is one line in any case, and it retires all four conditions at once:

session.upload_progress.enabled = 0

Set it in php.ini (or a conf.d drop-in), restart the web service, and the risk closes. PHP recommends exactly this until the fix ships in the next routine release. If you already disabled session upload progress on October 21 for CVE-2026-109619, you have nothing more to do for CVE-2026-115560: it is the same switch.

Worth knowing what the emergency patches do not cover: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixed CVE-2026-109618 and CVE-2026-109619, and the new issue is separate from both. A fully updated server still carries the second unpatched RCE until the regular fix lands.

What to Check on Your PHP Server Tonight

Three checks, in priority order, each with the exact command where one exists.

Check 1: your PHP version against the fix line. The emergency fixes landed as PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, and PHP now supports only 8.2 and later. Run:

php -v

At or above those numbers for your branch: the PHP2Shell pair is closed on your server, and only the second unpatched RCE question remains. Below them: update, because the pair is the part actually being attacked. If your host manages PHP, the same question goes to them, phrased exactly: “Which PHP point release are you running, and does it contain CVE-2026-109618 and CVE-2026-109619 fixes?”

Check 2: your session.upload_progress setting. Open your php.ini (or conf.d drop-ins, and for PHP-FPM the per-pool configuration such as /etc/php/8.3/fpm/pool.d/www.conf), and look for session.upload_progress.enabled. Absent means enabled, because it is on by default. The FPM form is:

php_admin_flag[session.upload_progress.enabled] = off

Reload the workers after the change and confirm the value in a request served by PHP-FPM, not on the command line, because the CLI reads a different configuration source.

Check 3: your serialize-handler configuration, for the new CVE. Search your application’s configuration for session.serialize_handler, and your code for ini_set calls touching the session handler. If the handler never changes from config to runtime, and the setting was never php_binary or php_serialize, your exposure to CVE-2026-115560 ends with the upload-progress switch above. This is the check most teams can complete in five minutes with a text search.

Verification for the patch itself, copied from the package maintainers’ guidance: on Debian and Ubuntu, zgrep CVE-2026-109618 /usr/share/doc/php8.1-common/changelog.Debian.gz, and on RHEL-family servers, rpm -q --changelog php-common | grep CVE-2026-109618. A fixed package keeps its version number and adds the CVE to its changelog, which is exactly how you prove the backport landed.

The Second Unpatched RCE and the Attack Reality Behind PHP2Shell

The second unpatched RCE has not been attacked. The two patched flaws have been attacked hard, and the numbers explain why the patch-check routine matters more than ever.

According to Sansec’s forensics timeline, Cloudflare saw early attacks at 07:43 UTC on October 21, before the 14:00 UTC release, and exploit attempts rose from tens of thousands within forty-five minutes of disclosure to millions by early October 22. Amazon’s honeypots recorded an attempt on October 17, four days before the flaws were public. Sophos and Arctic Wolf reported attackers trying to install a Mirai botnet variant with them.

The reassuring half: nobody has shown a single request that works against any vulnerable server, the public proof-of-concepts fail against a default PHP installation, and most working attempts require the target to also carry a local file inclusion bug, itself a severe flaw. Previdian and Wordfence report scanning and probing with no confirmed code execution. The summary from the researchers: a reliable exploit is proving harder to build than the CVSS 9.2 rating suggested, because every known trigger requires conditions specific to the target.

One trigger condition that is general: every known PHP2Shell trigger rides a multipart/form-data request, the format browsers use for file uploads. Multipart POST storms aimed at your PHP endpoints are the noise worth alerting on this month. The GitHub advisory for CVE-2026-109619 lists the same session.upload_progress.enabled=0 mitigation.

The memory-disclosure detail deserves its own line for anyone who stores secrets on the same machine: CVE-2026-109618 can return freed worker memory inside a PHPSESSID response cookie, and that memory can carry passwords, session tokens, API keys, and TLS private keys from other requests. The handler runs before application code, so the leak works even when the application never calls session_start(). Patching is the only real answer, and our exposed API key rotation routine is the companion move if that class of leak is even a possibility on your stack.

If Your PHP Version Is Old, the Backport Ladder

PHP publishes no fixed release for 8.1 or older, but the security team published source patches, and package maintainers backported the fix. The practical map, from the Sansec guidance:

• Debian and Ubuntu: the deb.sury.org repository and Ondřej Surý’s ppa:ondrej/php carry fixed packages for 5.6, 7.4, 8.0, and 8.1
• Ubuntu 22.04: a fixed 8.1 package from Ubuntu itself
• RHEL-family (AlmaLinux, Rocky, Fedora): Remi’s repository carries 7.4, 8.0, and 8.1
• cPanel on CloudLinux: fixed packages from ea-php52 through ea-php85
• Rolling ELS subscriptions: TuxCare and ZendPHP Long-Term Support cover 5.x through 8.1 branches

After any backport install, restart PHP-FPM or Apache, then confirm the CVE in the package changelog with the commands above. On panels like Plesk or cPanel without CloudLinux, update PHP through the panel and read its changelog for the CVE number.

One piece of history worth keeping: several Dutch sites, including Tweakers and the House of Representatives, went offline on October 21 purely as a precaution. Sansec’s verdict stands and travels well: you do not need to take your site offline. A version check, one configuration line, and the update cover everything recorded so far.

The WordPress and plugin angle sits in the same family worth one look: PHP-level flaws reach every application on the engine, which is the same lesson as the Elementor Pro vulnerability that let strangers upload PHP to WordPress servers, and the patch-verification habit matches our FortiMail zero-day patch verification playbook.

For the wider release-discipline picture, the EU’s duty to report actively exploited flaws under the Cyber Resilience Act now runs in parallel with the ecosystem’s own disclosure rhythm, and PHP’s own cycle this month shows what coordinated disclosure looks like at its best: an emergency pair on October 21, a rare-case note on October 23, and the routine fix to follow, with the second unpatched RCE closing on schedule exactly as the cycle intends. The full PHP2Shell breakdown remains our standing reference for the October 21 pair itself.

The Disclosure Week Timeline at a Glance

One compressed timeline explains why the week produced two separate headlines, and where each fix stands.

August 1: researcher Ryan Austin of Calif finds multiple RCE paths in the PHP engine. August 11: Calif reports the first bug and coordinated disclosure begins. August 24: Wiz Research independently reports the vulnerabilities to PHP. October 20: details leak, and watchTowr confirms working remote code execution. October 21, 07:43 UTC: Cloudflare sees the first attacks; at 14:00 UTC PHP ships the emergency releases for CVE-2026-109618 and CVE-2026-109619, ending the mass-target window. October 23: PHP’s advisory adds the second unpatched RCE, CVE-2026-115560, assigned to the routine cycle because its four-condition setup is rare.

Two fixes, two tempos, one lesson from the whole month: the emergency lane exists for the mass-target flaws, and the routine lane catches the narrow ones, but both reach the same reader action, a patched PHP and a disabled upload-progress default. The teams that ran the one-setting mitigation on October 21, before the second disclosure even existed, were unknowingly ahead of PHP’s second unpatched RCE by two days, which is exactly how a calm patch habit beats a panicked one.

If this intelligence helps you, you can add WorldNgayon as a preferred source on Google – free, one click, and it helps other Filipinos find the answers faster.

FAQ

What is CVE-2026-115560?

The second unpatched RCE PHP disclosed in October 2026. It can allow code execution only in applications that set session.serialize_handler to php_binary or php_serialize, switch it to “php” at runtime via ini_set() before calling session_start(), and still have session upload progress enabled. PHP rates the setup as unlikely in practice and plans the fix for the next routine release.

How do I close the second unpatched RCE on my PHP server?

One setting: session.upload_progress.enabled = 0, applied in php.ini or your PHP-FPM pool configuration, followed by a service reload. It disables the upload-progress feature the issue needs, and it is the same mitigation PHP listed on October 21 for CVE-2026-109619, so a server that applied it then is already covered.

Which PHP versions fix the PHP2Shell flaws?

The emergency releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, shipped October 21, 2026, fixing CVE-2026-109618 and CVE-2026-109619. For PHP 8.1 or older, use a backported package from deb.sury.org, Ubuntu, Remi’s repository, CloudLinux, or a Long-Term Support provider, and confirm the fix with the changelog commands in this article.

Are the PHP2Shell flaws being exploited in the wild?

Heavily, but unsuccessfully so far: Cloudflare counted exploit attempts rising from tens of thousands within forty-five minutes of the October 21 disclosure to millions by the next morning, Amazon’s honeypots logged a pre-disclosure attempt on October 17, and attacker attempts include installing a Mirai botnet variant. No confirmed code execution against a real server has been reported, because public exploits need extra conditions such as a local file inclusion bug on the target.

Should I take my website offline because of these PHP flaws?

No. The Dutch sites that went dark on October 21 did so as a precaution, and researchers’ verdict is that a version check, the session.upload_progress setting, and the PHP update cover every recorded threat. Blocking multipart/form-data requests at the web server is a temporary, partial measure, and it breaks file uploads until it is removed.

How do I prove the PHP patch actually landed on my server?

Check the package changelog for the CVE number: on Debian or Ubuntu run zgrep CVE-2026-109618 /usr/share/doc/php8.1-common/changelog.Debian.gz (with your version’s path), and on RHEL-family systems run rpm -q –changelog php-common | grep CVE-2026-109618. A fixed backport keeps the version number and adds the CVE to the changelog, which is the proof.

Does the second unpatched RCE share a root cause with PHP2Shell?

PHP has not said. The project has not listed affected versions, published a severity score, or confirmed any relation between CVE-2026-115560 and the October 21 flaws, and no exploitation of the new issue has been reported. What is confirmed is the narrow four-condition setup and the one-line mitigation, both documented in PHP’s October 23 advisory.

@online{agron2026phpsecond,
  author       = {Agron, Edmon},
  title        = {{PHP’s Second Unpatched RCE Risk: What to Check on Your Server}},
  year         = {2026},
  date         = {2026-11-10},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/php-second-unpatched-rce/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - PHP’s Second Unpatched RCE Risk: What to Check on Your Server
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/10/
UR  - https://worldngayon.com/php-second-unpatched-rce/
Y2  - 
ER  -