PHP has disclosed a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Announced in an informational advisory on October 23, the newly identified issue affects only web applications using an uncommon configuration. PHP considers the risk unlikely and plans to address it in a routine release rather than issuing an emergency patch.

The vulnerability can affect applications that configure the session.serialize_handler option as php_binary or php_serialize, subsequently change it to php using ini_set() before calling session_start(), and have session upload progress enabled. Applications that do not dynamically change their session serialization handler are not exposed through this attack path.

PHP recommends disabling session upload progress by setting session.upload_progress.enabled=0 until a fix becomes available. This setting is enabled by default and allows applications to track file upload progress. Administrators who already applied this mitigation following the October 21 advisory for CVE-2026-109619 do not need to take additional action for the newly disclosed issue.

PHP has not yet identified the affected versions, confirmed the releases that will contain the fix, or assigned a severity score. No exploitation of CVE-2026-115560 has been reported.

Meanwhile, exploitation attempts targeting the earlier PHP2Shell vulnerabilities have increased significantly. Researchers reported detecting exploit attempts in its honeypots on October 17, four days before public disclosure. Cloudflare also observed activity escalating from tens of thousands of attempts within 45 minutes of disclosure to millions by early October 22.

Threat actors have attempted to deploy a Mirai botnet variant by exploiting the earlier vulnerabilities, according to different security firms. However, researchers have reported scanning and probing without confirmed code execution, indicating that reliable exploitation remains challenging. These attacks target the previously disclosed PHP2Shell flaws, not CVE-2026-115560.