--- title: There's a third PHP2Shell bug, but it won't get an... description: A third PHP remote code execution bug has been found alongside the two that make up PHP2Shell, but it won't get an emergency patch. The PHP Foundation reserved... canonical: https://daily.dev/posts/there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-vyduakzcw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: There's a third PHP2Shell bug, but it won't get an emergency fix | daily.dev og:description: A third PHP remote code execution bug has been found alongside the two that make up PHP2Shell, but it won't get an emergency patch. The PHP Foundation reserved... og:url: https://daily.dev/posts/there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-vyduakzcw og:image: https://api.daily.dev/og/posts/vydUAkZcw.png og:image:alt: There's a third PHP2Shell bug, but it won't get an emergency fix og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # There's a third PHP2Shell bug, but it won't get an emergency fix **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary A third PHP remote code execution bug has been found alongside the two that make up PHP2Shell, but it won't get an emergency patch. The PHP Foundation reserved CVE-2026-115560 and will fix it in the next regular PHP release instead. It requires an unlikely setup: an app must switch session.serialize_handler to php at runtime via ini_set() with session upload progress enabled. Until then, PHP Foundation recommends setting session.upload_progress.enabled=0. As of Friday, no publicly confirmed successful PHP2Shell attacks have been attributed to the bugs, though Mandiant's Charles Carmakal says some validated proof-of-concepts achieve RCE against mod_php but not PHP-FPM. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-115560 and why isn't PHP issuing an emergency patch for it? CVE-2026-115560 is a third PHP remote code execution flaw related to PHP2Shell that requires a very unlikely combination of configuration and application code, according to the PHP Foundation. It needs session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), with session upload progress enabled. Because this setup rarely occurs in practice, it will be fixed in the next regular PHP release instead of an emergency patch. _Developers tracking PHP security advisories can follow CVE fixes and mitigation timing on daily.dev._ ### How do I mitigate CVE-2026-115560 before the next PHP release fixes it? Set session.upload_progress.enabled=0 in your PHP configuration until the next regular bugfix release. The PHP Foundation published this as an informational advisory because the vulnerable configuration, switching session.serialize_handler to php at runtime before session_start(), is considered unlikely in real-world applications, so no emergency patch is planned. _Teams hardening PHP configs against RCE risks can keep tabs on advisories like this via daily.dev._ ### Has PHP2Shell (CVE-2026-109618 and CVE-2026-109619) led to any confirmed successful attacks? As of the Friday update, there were no publicly confirmed successful compromises attributed to PHP2Shell, despite mass exploitation attempts and multiple proof-of-concept exploits circulating both before and after disclosure. Mandiant CTO Charles Carmakal said some validated PoCs can achieve remote code execution against default mod_php deployments but not PHP-FPM, and warned limited exploitation may already be underway. _Security teams assessing real-world PHP2Shell risk can track exploitation updates on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-vyduakzcw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"There's a third PHP2Shell bug, but it won't get an emergency fix","url":"https://daily.dev/posts/there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-vyduakzcw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-vyduakzcw"},"datePublished":"2026-10-23T20:08:26.684Z","dateModified":"2026-10-23T20:09:46.935Z","description":"A third PHP remote code execution bug has been found alongside the two that make up PHP2Shell, but it won't get an emergency patch. The PHP Foundation reserved...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2f0a722a4f8e5cb8e8c7bcc5595ac3c5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2f0a722a4f8e5cb8e8c7bcc5595ac3c5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-vyduakzcw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"There's a third PHP2Shell bug, but it won't get an emergency fix"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-vyduakzcw#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-115560 and why isn't PHP issuing an emergency patch for it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-115560 is a third PHP remote code execution flaw related to PHP2Shell that requires a very unlikely combination of configuration and application code, according to the PHP Foundation. It needs session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), with session upload progress enabled. Because this setup rarely occurs in practice, it will be fixed in the next regular PHP release instead of an emergency patch. Developers tracking PHP security advisories can follow CVE fixes and mitigation timing on daily.dev."}},{"@type":"Question","name":"How do I mitigate CVE-2026-115560 before the next PHP release fixes it?","acceptedAnswer":{"@type":"Answer","text":"Set session.upload_progress.enabled=0 in your PHP configuration until the next regular bugfix release. The PHP Foundation published this as an informational advisory because the vulnerable configuration, switching session.serialize_handler to php at runtime before session_start(), is considered unlikely in real-world applications, so no emergency patch is planned. Teams hardening PHP configs against RCE risks can keep tabs on advisories like this via daily.dev."}},{"@type":"Question","name":"Has PHP2Shell (CVE-2026-109618 and CVE-2026-109619) led to any confirmed successful attacks?","acceptedAnswer":{"@type":"Answer","text":"As of the Friday update, there were no publicly confirmed successful compromises attributed to PHP2Shell, despite mass exploitation attempts and multiple proof-of-concept exploits circulating both before and after disclosure. Mandiant CTO Charles Carmakal said some validated PoCs can achieve remote code execution against default mod_php deployments but not PHP-FPM, and warned limited exploitation may already be underway. Security teams assessing real-world PHP2Shell risk can track exploitation updates on daily.dev."}}]} ```