Experts reveal another major PHP2Shell bug — and it's not getting an emergency patch this time

PHP disclosed a new RCE vulnerability, but exploitation requires a rare and specific configuration setup Unlike php2shell, the flaw will be fixed in the next regular release rather than an emergency patch Researchers say php2shell attacks remain limited so far, though widespread patching is still ur

<![CDATA[ <article> <ul><li><strong>PHP disclosed a new RCE vulnerability, but exploitation requires a rare and specific configuration setup</strong></li><li><strong>Unlike php2shell, the flaw will be fixed in the next regular release rather than an emergency patch</strong></li><li><strong>Researchers say php2shell attacks remain limited so far, though widespread patching is still urgently needed</strong></li></ul><p>The PHP Security Team has discovered yet another remote code execution (RCE) vulnerability in the now-notorious programming code, but since the issue is not that easy to abuse, it won’t receive an out-of-bounds fix.</p><p>The organization recently published a <a href="https://www.php.net/" target="_blank" rel="nofollow">new security advisory</a> warning users about a session upload progress bug in PHP, tracked as CVE-2026-115560. In the advisory, the organization said the bug can only be abused “under an unusual combination of configuration and application code”.</p><p>“An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled,” the advisory reads.</p><p>So, unless your setup has these exact settings, you’re not at risk. The PHP Security Team also suggests users set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from this RCE vector, which they explained as “unlikely”. They also said this setting was listed as a mitigation for CVE-2026-109619, so users who applied it then should just keep it and do nothing else. </p><h2 id="php2shell">PHP2Shell</h2><p>CVE-2026-109619 is one of two critical-severity RCE vulnerabilities recently discovered and dubbed “<a href="https://www.techradar.com/computing/internet/no-the-internet-isnt-dying-due-to-one-of-the-most-significant-vulnerabilities-of-2026-but-this-is-what-you-need-to-know" target="_blank">php2shell</a>”, the discovery of which caused widespread panic, since the implications were monumental, to put it mildly. </p><p>PHP is an extremely popular programming language used to build websites and web apps. Some analysts claim that roughly 70% of all websites on the internet are running PHP, including banking, education, healthcare, and government sites. It was revealed that the PHP Security Team was working on a fix for php2shell and that a handful of security organizations knew, or were involved in the work. The bugs allowed threat actors to take full control over the websites. </p><p>The organizations were told not to break the news until a <a href="https://www.techradar.com/best/best-patch-management-tools" target="_blank">patch </a>was released, in order not to alert cybercriminals of the existence of the flaws. However, information somehow leaked, and Amazon Web Services’ team saw exploitation attempts four days before the patch was due. </p><p>A few hours before the release, the CEO of security outfit Chainguard published container images containing fixes for the flaws, effectively breaking the embargo. The security community blamed him for what happened next - the number of attempted exploits grew to a few hundred, then a few thousands, then into the millions - all in a few hours following the release of the patch.</p><p>The PHP Security Team tried to mitigate the damage by issuing a “heads up” alert - telling IT teams to prepare and wait for the patch, which was scheduled for October 21. </p><h2 id="saved-by-aslr">Saved by ASLR</h2><p>This mass exploitation campaign - apparently launched by multiple threat actors - is what caused widespread panic. According to different sources, healthcare, government, and education companies across Europe preemptively shut down their websites as they waited for the fix. However, despite the seriousness of the flaw and the speed at which threat actors picked it up - very few breaches actually happened. </p><p>As it turns out - exploiting php2shell is not as easy as it seems, likely thanks to a feature called Address Space Layout Randomization (ASLR). This security feature randomly changes where a program’s code and data are stored in memory every time it runs, allegedly complicating things for the attackers: </p><p>“PHP2Shell doesn't seem trivial to exploit. I believe that part of the reason we’ve yet to see successful exploitation is that reliable code execution requires getting past ASLR, a memory protection that randomizes where code sits in memory,” said Yotam Perkal, Director of Security Research at Pluto Security. “That's hard to do remotely, and most of the public PoCs floating around (many of them vibe coded) simply don't work reliably on real systems.”</p><p>This is great news, but Perkal believes the best ASLR can do is buy security teams a little time: “I wouldn't count on it staying that way, though. Exploits will get better, and most PHP servers out there are still unpatched, so teams should patch and restart their PHP workers now. But compared with all the drama before and after the release, real-world exploitation so far looks pretty limited.”</p><p><em>Via </em><a href="https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/" target="_blank"><em>BleepingComputer</em></a></p> </article> ]]>