Developers relying on PHP, which powers nearly 70% of websites globally, face a new remote code execution threat without an immediate patch. The PHP security team disclosed mitigation steps for CVE-2026-115560, a flaw that requires an unusual setup to exploit. According to VirusTotal data, more than 5.1 million PHP hosts sit exposed on the internet, with approximately 3.8 million having at least one port accessible to potential attackers.
The vulnerability only becomes exploitable under specific circumstances. As the PHP team explained, "An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled." The team noted that such a configuration combination is uncommon in practice.
Until a patch arrives, administrators can disable the vulnerable feature by setting session.upload_progress.enabled=0. The PHP developers recommended applying this mitigation immediately and keeping it in place. "Applications that never change the serialize handler at runtime can keep the feature enabled," the team stated, adding that "Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release."
PHP2Shell flaws under active attack
Separate critical vulnerabilities tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) received patches on Wednesday, one day after the PHP team urged administrators to deploy updates immediately upon release. The timing proved crucial, as attackers began probing for these flaws before patches became available.
Security firms including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack detected unsuccessful exploitation attempts before public disclosure. The early activity followed a leak of vulnerability details, including CVE identifiers and mitigation advice that had been shared with critical infrastructure operators. Amazon Threat Intelligence researchers observed attackers targeting the PHP2Shell flaws four days before patches dropped on Wednesday.
"The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems," said CJ Moses, chief information security officer at Amazon Web Services. He added that "PHP2Shell is now seeing broad exploitation attempts in the wild," though the success rate remains unknown.
Dataminr's Threat Research and Cyber Engineering team reported that while proof-of-concept code circulated before patches went live, none of the published versions were functional. The team's Thursday assessment found that "observed activity since vulnerability disclosure remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises," but cautioned that "it remains only a matter of time for working POCs or successful exploitation activity to emerge."