[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

confirmed (php.net informational advisory, Oct 23; no fix, versions or score yet; no exploitation reported)

PHP issues a new informational advisory, CVE-2026-115560: an unlikely RCE path through session upload progress that the PHP2Shell releases don't fix; set session.upload_progress.enabled=0

Two days after the PHP2Shell emergency releases, the PHP project posted an informational advisory on Oct 23 about another remote code execution vector, tracked as CVE-2026-115560. It is separate from CVE-2026-109618/109619, and 8.5.12, 8.4.27, 8.3.36 and 8.2.35 do not fix it.

  • Who is exposed: only applications that set session.serialize_handler to php_binary or php_serialize in configuration, then switch it to php at runtime with ini_set() before calling session_start(), while session upload progress is still enabled. PHP calls this setup unlikely in practice.
  • Mitigation: set session.upload_progress.enabled=0 until the next regular bugfix release. It is the same setting PHP already listed as a mitigation in the CVE-2026-109619 advisory (GHSA-6wmf-4rv5-p3rp) on Oct 21, so if you applied it then, keep it in place.
  • Not yet published: affected versions, fixed releases and a severity score. PHP will publish a full advisory with the next regular release rather than shipping an emergency fix.

No exploitation of CVE-2026-115560 has been reported. The in-the-wild activity since Oct 21 targets the two earlier PHP2Shell CVEs, so patching those is still the priority.

Sources: php.net: Informational advisory: Session upload progress (Oct 23) · PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, lists the same mitigation) · The Hacker News: PHP warns of another unpatched RCE (Oct 23)