PHP discloses a new unpatched code-execution flaw as Mirai operators join PHP2Shell attacks
CVE-2026-115560 only affects unusual configurations, and PHP has shared a mitigation. Researchers have shown an ASLR bypass for PHP2Shell, but no successful compromise has been confirmed.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
Days after shipping emergency fixes for the PHP2Shell vulnerabilities, the PHP security team has disclosed another remote code execution flaw, CVE-2026-115560, which does not yet have a patch. According to BleepingComputer, it can only be exploited on systems with an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize, switch it to php at runtime before calling session_start(), and still have session upload progress enabled. PHP will fix the flaw in its regular release cycle and recommends setting session.upload_progress.enabled=0 until then. Anyone who applied that setting earlier this week can leave it in place. Attacks on the original PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, are also evolving. SecurityWeek reports that threat actors have tried to use them to spread a Mirai botnet, that a security firm has built an exploit that bypasses ASLR memory protection, and that an exposed attacker server revealed custom tooling. No successful compromise in the wild has been confirmed so far. Many organizations took systems offline as a precaution: several government, school and hospital websites in Europe went dark on October 21, and the UK government said 32 of its services were unavailable and four partly unavailable, mostly because of precautions taken while patches were applied.