PHP security team issues mitigation for unpatched remote code execution vulnerability

The PHP security team released mitigation guidance on October 23, 2026, for a new remote code execution vulnerability tracked as CVE-2026-115560. BleepingComputer and The Hacker News both report that the vulnerability has no available security patch and affects systems running non-default server configurations. BleepingComputer notes that the project considers the flaw an unlikely risk that can only be exploited when target applications use an unusual combination of settings. [1][3]

According to BleepingComputer, successful exploitation requires specific application conditions, such as custom session serialization settings. PHP powers nearly 70 percent of all internet websites, with VirusTotal estimating that over 5.1 million PHP hosts are accessible online and roughly 3.8 million have open ports. [1]

The discovery comes shortly after the project released emergency security patches for earlier critical vulnerabilities. Snyk, OX Security, Unite.AI, and FindArticles reported on earlier emergency fixes for two unauthenticated remote code execution flaws, identified as CVE-2026-109618 and CVE-2026-109619. The Hacker News adds that the advisory for CVE-2026-115560 was published two days after those emergency patches, which addressed the PHP2Shell vulnerabilities. [2][3][5][7][8]

System administrators are advised to apply the configuration mitigations provided in the official PHP security advisory until a permanent patch is released. The PHP project has not issued a formal software update for CVE-2026-115560 because the issue depends on non-standard application code and server setup. [1][3]