InfoSecBulletin Cybersecurity for mankind
The PHP security team shared ways to protect against a new flaw that lets someone run unwanted code on certain systems. This affects systems that are not set up with default settings and there is no fix yet.
According to a Friday advisory, this security flaw (tracked as CVE-2026-115560) can only be exploited when targeting systems “with an unusual combination of configuration and application code.”
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
“An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled,”the PHP team explained
.
“Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.”
Until a security patch is available, the PHP devs suggested setting session.upload_progress.enabled=0, adding that “If you applied it then, keep it in place and no further action is needed.”
This fix should have already been put in place on Wednesday, before fixing two other serious RCE weaknesses (CVE-2026-109618 and CVE-2026-109619) tracked together as PHP2Shell.
PHP2Shell flaws targeted in attacks
The PHP security team fixed the PHP2Shell problems one day after asking admins to be ready to install the updates when they were released. Although some example code was shared before the patches were available, the PHP security team said none of it worked.
Several cybersecurity companies like Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack found failed attempts to exploit problems before they were made public. Some details about the PHP2Shell security issues, including CVE IDs and advice given to key infrastructure providers, leaked online.
Related news:
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
