On Friday, the PHP Foundation told The Register it has reserved CVE-2026-115560 for a third remote-code flaw in the same session feature behind PHP2Shell, but it will not issue an emergency patch. The flaw needs an unlikely combination of server settings and application code that the Foundation says it does not expect in practical use, and a single configuration change blocks it until the next regular PHP release. The decision lands as mass exploitation attempts against the first two flaws continue, though no successful compromise has been publicly confirmed.
A Third Flaw In The Same Feature
The new flaw sits in PHP’s session upload progress feature, the same area as the two flaws disclosed on Wednesday. According to The Register, the Foundation reserved the identifier CVE-2026-115560 on Friday and published an informational advisory on the PHP website rather than a full security release.
Triggering it requires a narrow setup. An application must set its session serialize handler to php_binary or php_serialize, then switch it to php at runtime with ini_set() before calling session_start(), while session upload progress stays enabled. The Foundation’s executive director, Elizabeth Barron, told The Register the combination is very unlikely in real-world applications.
Why The Foundation Is Waiting
Barron told The Register the flaw “requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP.” Because a configuration setting mitigates it, the Foundation chose the regular release cycle over an emergency patch. The advisory tells users to set session.upload_progress.enabled=0 until the next regular bugfix release, which it says fully protects against the unlikely attack route.
The restraint contrasts with the urgency around the first two flaws. Those flaws, CVE-2026-109618 and CVE-2026-109619, drew millions of exploitation attempts and emergency patching across the web after their Wednesday disclosure. PHP powers about 70 percent of websites with a known server-side programming language, according to The Register, which is why even a narrow flaw gets a public advisory.
No Confirmed Compromise Yet, But PoCs Circulate
As of Friday, no publicly confirmed successful compromise has been linked to PHP2Shell, The Register reported. Barron said the Foundation has no evidence of successful exploitation of the two Wednesday flaws before disclosure, or on patched versions since. She added that the Foundation received no further indication from OpenAI, Wiz or Calif, the groups it is working with on the issue, of problems on patched systems.
Security researchers told The Register they have documented exploitation attempts but no confirmed successful attacks in the wild. Mandiant chief technology officer Charles Carmakal wrote on Friday that exploitation may already have begun in a limited fashion and called the threat viable and very serious. He said several proof-of-concept exploits are circulating, some incapable of remote code execution, but some validated as capable of it against default mod_php deployments, though not against PHP-FPM.
Why It Matters
The third flaw matters less as an emergency than as a warning about the feature itself. Three flaws in one session mechanism in a single week suggest the area deserves sustained review, even if this latest one needs a rare setup to trigger. For site owners, the practical step is small: one configuration line closes the route until the regular fix ships. For the wider web, the week shows how quickly a disclosure turns into mass scanning, and how much weight a single open-source project’s triage calls now carry.
Background
PHP2Shell began with the Wednesday disclosure of two critical flaws found with AI-assisted research, which set off a global patching rush, millions of exploitation attempts, and follow-on findings including agentic attacks on European servers and Japan’s plan for AI cyberattack simulations. The PHP Foundation, which runs on a shoestring budget, has carried the triage through the week while researchers and vendors raced to contain the fallout.
Source: The Register
0 Comments