PHP Issues Urgent Advisory on New Code‑Execution Vulnerability After Recent Patch Rollout

The PHP development team has issued a fresh security advisory warning of a newly discovered code‑execution flaw, catalogued as CVE‑2026‑115560. The notice, released on Tuesday, comes merely two days after the project rolled out emergency patches addressing the PHP2Shell vulnerability, underscoring a period of heightened activity for the widely used scripting language.

According to the advisory, the vulnerability is considered "unlikely to be exploitable" under normal configurations, but the PHP maintainers recommend immediate mitigation. Administrators are urged to disable the session upload progress feature—a component that tracks the status of file uploads—until a dedicated fix is made available. Disabling the feature can be done through the php.ini setting session.upload_progress.enabled=0, a change that does not affect core functionality for most applications.

The timing of the alert has drawn attention from the security community, as the PHP2Shell patches were classified as emergency releases to close a backdoor that allowed attackers to execute arbitrary commands via specially crafted requests. While the new CVE does not appear to be directly related to PHP2Shell, its emergence highlights the challenges of maintaining a large, open‑source codebase that powers a substantial portion of the web.

Experts note that the session upload progress mechanism, introduced to improve user experience during large file transfers, can be leveraged in edge‑case scenarios to trigger unintended code paths. Although the advisory states that exploiting CVE‑2026‑115560 would require a precise set of conditions, the PHP team prefers a precautionary approach, especially given the recent history of rapid exploitation of previously unknown flaws.

PHP’s security response team has pledged to develop and distribute a patch for the vulnerability as soon as possible. In the interim, they advise developers to monitor official channels, apply the latest security updates, and review server configurations for any unnecessary exposure of the upload progress feature. The swift issuance of the advisory reflects a broader industry trend toward proactive disclosure and rapid remediation to protect the millions of sites that rely on PHP for dynamic content generation.