PHP has identified a new remote code execution vulnerability (CVE-2026-115560) affecting web applications with a rare configuration involving the session upload progress feature and session serialization settings. Unlike the recent critical PHP2Shell flaws patched on October 21, this issue is considered unlikely to be exploited and will be addressed in a routine future release; meanwhile, PHP advises disabling session upload progress as a mitigation. Exploitation attempts continue against the earlier PHP2Shell vulnerabilities, but no attacks targeting this new issue have been reported.
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html