The PHP security team has shared mitigation measures for a new remote code execution (RCE) vulnerability affecting systems with non-default configurations. This vulnerability, tracked as CVE-2026-115560, can only be exploited under specific conditions. To apply these measures, developers should set session.upload_progress.enabled to 0 and ensure that session.serialize_handler is not changed at runtime. These steps should be taken immediately to mitigate the risk. In addition to these measures, it is also important to apply patches for other critical RCE vulnerabilities, such as CVE-2026-109618 and CVE-2026-109619. These patches, collectively known as PHP2Shell, were released one day before the new RCE vulnerability. Developers should also be aware of the broader context of RCE vulnerabilities, as prevention scores drop significantly once attackers have valid credentials. To stay protected, it is crucial to monitor for and respond to any potential exploitation attempts. By following these practical steps, developers can significantly reduce the risk of RCE vulnerabilities in their PHP applications.
