PHP warns of unpatched RCE two days after emergency PHP2Shell patches

On October 23, PHP warned of an unpatched flaw that allows remote code execution, tracked as CVE-2026-115560, two days after the project shipped emergency patches for the PHP2Shell vulnerabilities.

PHP said it considers exploitation of CVE-2026-115560 unlikely because the flaw affects only unusually configured applications, so the project is not issuing an emergency fix. Instead, PHP recommends turning off session upload progress until a fix arrives in the next routine release.

An application becomes exposed when it sets session.serialize_handler to php_binary or php_serialize and then switches that setting to php with ini_set() before calling session_start(). Session upload progress runs by default, letting an application monitor an upload as it proceeds, and the application is exposed only while that feature stays on. The project advises setting session.upload_progress.enabled=0 until the next routine bug fix release.

People who set session.upload_progress.enabled=0 on October 21 and left that setting in place need take no further action for CVE-2026-115560. PHP had already named that setting as a mitigation for CVE-2026-109619 in its October 21 advisory.

PHP said it will address the CVE-2026-115560 fix through its regular release cycle instead of an emergency release, and it will publish a full advisory when the next version ships. The project has not said which versions the flaw affects, which releases will include the patch, or what severity rating applies. The flaw stands apart from the two critical PHP2Shell issues, and PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 do not include the fix.

No one has reported exploitation of CVE-2026-115560, while the attacks seen since October 21 aim at CVE-2026-109618 and CVE-2026-109619 instead. Amazon Threat Intelligence said its MadPot honeypot logged an exploitation attempt on October 17 from an IP address tied to a commercial anonymization service, and Tenable reports Amazon now describes PHP2Shell as broadly exploited in the wild.

Cloudflare said exploit attempts rose sharply after the October 21 disclosure, reaching tens of thousands within 45 minutes and millions by early October 22. Sophos and Arctic Wolf said attackers attempted to deploy a Mirai botnet variant using the PHP2Shell flaws.

The attempts have not succeeded: Previdian, Wordfence and others have observed scanning and probing without any confirmed code execution. Researchers say building a reliable exploit for the PHP2Shell flaws is proving more difficult than expected.

On October 21, 2026 at 14:00 UTC, the PHP security team released emergency patches for both PHP2Shell flaws. The two flaws are remote code execution bugs carrying a 9.2 rating under CVSS v4.0, while watchTowr’s chief executive and some early reports put them at CVSS 10.0.

Information about both flaws surfaced online on October 20, one day before the planned release and while the embargo was still active, pushing PHP to ship the patch sooner. PHP originally scheduled the release for later in the week, with an early shipment if details went public or exploitation appeared.

CERT-EU issued an advisory on October 20 urging organizations to consider isolating internet-facing applications from public networks. Authorities in the European Union, the Netherlands, Australia, Japan and Britain told PHP users to patch immediately or take sites offline until patching is possible. Public websites in the Netherlands and Finland went offline as a precaution, and the Dutch cybersecurity agency shut down its own site to avoid exposure.

Kevin Beaumont, a security researcher, said the expected fixed releases would be PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Wordfence said the fix will not arrive through automatic updates, so server owners need to determine who actually manages PHP on their systems.

On October 21 at 07:43 UTC, Cloudflare reported early attacks against PHP sites, and Chief Technology Officer Dane Knecht said the company was updating its mitigations as new vectors appear. Cloudflare put web application firewall rules for known exploit vectors in place for all customers, including the free tier, but described them as only a stopgap.

watchTowr said it reproduced CVE-2026-109618 in a lab setting, and Sansec expects mass attacks once the patch exposes the bug to attackers. A leaked exploit tool credited to Calif.IO and also called PHP2Shell includes a banner claiming it works against every PHP release starting with 5.4.0.

The update reaches only the four supported branches, PHP 8.2 through 8.5; releases from PHP 5.x through 8.1.x are end-of-life and are not expected to get an official patch. PHP 8.2 reaches end of life on December 31, 2026. PHP published minimal source backports for PHP 7.4, 8.0 and 8.1 aimed at people building from source or working without an LTS vendor. The volunteer-run Remi repository said it would not have updates on release day.

Wiz Research said the flaws “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”. Wiz researchers also said frontier AI models reduced the barrier to turning a long-standing flaw into an exploit.

Using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, Wiz Research said one researcher finished in a week work that once required a world-class team several months. Raluca Ada Popa, Head of Gemini Security at Google DeepMind, credited Gemini 4 Argon for helping find the vulnerability, build the exploit, detect the attack, and validate the patch. Ryan Austin of Calif found the same bug class while reviewing PHP under OpenAI’s Patch the Planet initiative. According to Calif’s write-up, the first confirmed out-of-memory fatal happened on August 1, the first bug report reached PHP on August 11, and the project confirmed a working exploit on August 15.

Wiz showed unauthenticated remote code execution against the most recent container images for WordPress, Drupal, and Joomla. Google Cloud said users running PHP on its infrastructure may be exposed. eSentire’s advisory cites unverified reports of exploit code circulating in the wild, but those reports remain unconfirmed. Code claiming to exploit the flaws is circulating, although the PHP Foundation said it had not identified a functional public exploit at the time of release.

The PHP security team traced both flaws to a single issue: an abnormal request ending can leave PHP memory corrupted. CVE-2026-109618 allows remote code execution as the web worker account through out-of-memory corruption. CVE-2026-109619 allows unauthenticated heap use-after-free, memory disclosure, and remote code execution using the web worker’s privileges. The PHP security team said, “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs”.

The PHP Foundation said Calif, OpenAI and Wiz, among others, deserve credit for the research and responsible disclosure. According to PHP core developer Gina Peter Banyard, no PHP2Shell mitigation can fully stop potential attacks. Official security patches are the only permanent fix.

W3Techs estimates PHP runs on 69.3% of websites with a known server-side language. Wiz Research says PHP powers 70% of websites worldwide. BleepingComputer says PHP powers 75% to 80% of websites.

VirusTotal estimates that more than 5.1 million PHP hosts are exposed online, and roughly 3.8 million of them have at least one port open. The UK National Cyber Security Centre told UK organizations to immediately update systems running PHP or take them offline until patching is possible.