InfoSecBulletin Cybersecurity for mankind
The PHP security team shared ways to protect against a new flaw that lets someone run unwanted code on certain systems. This affects systems that are not set up with default settings and there is no fix yet.
According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems “with an unusual combination of configuration and application code.”
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
“An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled,”the PHP team explained
.
“Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.”
Until a security patch is available, the PHP devs suggested setting session.upload_progress.enabled=0, adding that “If you applied it then, keep it in place and no further action is needed.”
This fix should have already been put in place on Wednesday, before fixing two other serious RCE weaknesses (CVE-2026-109618 and CVE-2026-109619) tracked together as PHP2Shell.
PHP2Shell flaws targeted in attacks
The PHP security team fixed the PHP2Shell problems one day after asking admins to be ready to install the updates when they were released. Although some example code was shared before the patches were available, the PHP security team said none of it worked.
Several cybersecurity companies like Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack found failed attempts to exploit problems before they were made public. Some details about the PHP2Shell security issues, including CVE IDs and advice given to key infrastructure providers, leaked online.
Related news:
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
