Zero Radar
← feed
HighVulnerabilityCVE-2026-115560updated 25 Oct 2026, 20:03 UTC

PHP web apps can run attacker code in an unusual setup; no patch yet

Under a rare combination of settings and app code, an attacker could make a PHP website run commands on its server. PHP says the setting to turn off is a simple switch, and no emergency update is out yet.

No fix yetOfficial, 3 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships · since 25 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted upload to the session feature
  2. 2App switches handlerRuntime ini_set() changes serialize handler
  3. 3Session data parsedUpload progress data is deserialized
  4. 4Code runs on serverUnsafe handling allows command execution
  5. ResultAttacker runs code on the web server

What happened

A remote code execution flaw (CVE-2026-115560) affects PHP applications that combine session.serialize_handler set to php_binary or php_serialize, switched to php at runtime via ini_set() before session_start(), while session upload progress remains enabled.

Why it is dangerous: If exploited, an attacker could run code on the web server, which can expose data or let them take over the site. PHP rates the risk as unlikely because the setup is unusual.

Are you affected?

You are affected if your PHP application sets session.serialize_handler to php_binary or php_serialize, changes it to php with ini_set() before session_start(), and has session.upload_progress.enabled turned on.

PHP (version not stated in the material); only applications with the unusual configuration and code pattern described above.

What to do

  1. Set session.upload_progress.enabled=0 in your PHP configuration
  2. If you already applied this for CVE-2026-109619, keep it in place and take no further action
  3. Watch for the full PHP advisory and update to the next PHP release when it ships

Timeline

  1. 23 Oct 2026, 10:12 UTC
    Publicly disclosed
  2. 23 Oct 2026, 11:25 UTC
    Reported by The Hacker News · The Hacker News
  3. 23 Oct 2026, 15:38 UTC
    Reported by BleepingComputer · BleepingComputer
  4. 25 Oct 2026, 20:03 UTC
    PHP reported on it · PHP

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-115560 · ZR-5d4b1321
Disclosed
23 Oct 2026, 10:12 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 20:03 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PHP web apps can run attacker code in an unusual setup; no patch yet · Zero Radar