CVE-2026-115560: new PHP vulnerability, no patch available yet
Published 23.10.2026 · Severity level : Medium · Updated 27.10.2026
What is happening: On 23 October 2026, PHP announced a new vulnerability, CVE-2026-115560, that could allow remote code execution on the server. It came two days after the patches for PHP2Shell, and the updated versions from 21 October do not fix it.
How serious is it: According to PHP, exploiting the vulnerability requires an unusual combination of settings and code: the website must switch the session data format while running, and the upload progress feature must be enabled. No attacks have been reported so far (CERT-FR, 27 October 2026). PHP will fix the bug in the next regular release.
Who is affected: websites running on PHP – including WordPress, Joomla, Drupal and many e-commerce sites – where the upload progress feature (session.upload_progress) is enabled. It is enabled by default.
What you should do: PHP recommends setting session.upload_progress.enabled=0 until the fix is available, either in php.ini or in the server configuration, and then restarting the PHP processes. This setting is only used to display progress during file uploads; most websites will notice no difference. Install the next PHP release as soon as it becomes available.
Are you unsure whether your website has been affected? Contact us, and we will tell you what should be done.