Following recent emergency patches, PHP issued an advisory for a new potential code execution vector tracked as CVE-2026-115560.
The issue requires a specific setup involving session upload progress and serialization.
PHP considers the risk unlikely and recommends disabling session upload progress as a temporary mitigation until a routine release becomes available.
The new issue only affects applications that are configured in an unusual way and the team considers the risk to be low. For this reason, there will be no immediate emergency update. Instead, it is recommended to disable the download progress tracking feature until the next scheduled update is released.
The warning was issued on October 23, shortly after the October 21 emergency patch that addressed two critical issues in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 that allowed unknown parties to run code. The new issue is separate and unrelated to those previous ones.
Who is at risk from the new issue?
The risk only concerns a very specific and unusual setup that combines changes to a session's configuration options with active file upload monitoring.
READ ALSO
Serious security issues in popular Python library Pillow
Because this configuration is rarely encountered in practice, the issue is addressed within the regular PHP update cycle. No attempts to exploit the new issue have been reported.
The situation with previous attacks
In contrast to the new issue, attempts to exploit the two previous issues have increased significantly. Major technology and security companies including Amazon, Cloudflare, Sophos, Arctic Wolf, Previdian, and Wordfence have reported scans, recordings, and attempts by variants of known automated network programs.
Despite the increased scans, researchers note that creating a credible attack program is proving more difficult than expected, with some monitoring companies reporting that there are still no confirmed cases of successful code execution.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)