The dust around the PHP 2Shell flaws has not yet settled, and the security researchers have already warned of a new security issue that could allow attackers to run code on a web server under specific conditions. Just two days ago the firm released an emergency update for two critical PHP2Shell flaws. However, the newly identified issue tracked as CVE-2026-115560 reportedly affects applications with an uncommon configuration involving session handling and file upload tracking. PHP believes that the risk with this newly found vulnerability is low and it will not release an urgent fix. Instead, it has advised developers to turn off session upload progress until a fix is included in a regular update.
PHP recently identified a new vulnerability, CVE-2026-115560, that only affects web applications configured in an unusual way and has warned the users about it. According to the advisory shared by PHP, the issue arises when an application uses certain session serialisation settings in its configuration, changes them while running, and makes the change before starting a session.
The application must initially use either php_binary or php_serialize for the session. serialize_handler setting, then switch it to php using ini_set() before calling session_start(). Session upload progress must also remain enabled for this risk to apply.
PHP has also added in the advisory that this combination is unlikely to be found in typical applications. Systems that do not change the serialisation setting while running are not exposed through this specific method.
Also read: Diwali 2026: 5 WhatsApp features that can protect you from scams
PHP has recommended setting session.upload_progress.enabled=0 as a temporary safety measure until a routine bugfix release becomes available. The feature is enabled by default and allows applications to track the progress of file uploads.
Developers who already applied this setting following the October 21 advisory do not need to take further action for the new issue. PHP plans to publish a full advisory alongside the release containing the fix.
Also read: Vivo V80 vs Oppo Reno 16 vs OnePlus 15R: Price in India, camera, battery and other specs compared
The project has not yet identified the affected versions, confirmed which releases will carry the patch, or assigned a severity score. It has also not explained whether the new issue shares a root cause with the earlier vulnerability CVE-2026-109619.