x.comadvisoryXavier Rivera (@XavierRiveraX) on X
CVE-2026-115560 is a PHP code execution bug reported two days after the PHP2Shell emergency patches. The post says those releases do not fix it and no emergency fix is planned. Only apps that switch session.serialize_handler to php via ini_set() before session_start() are exposed. The mitigation is session.upload_progress.enabled=0, which also covers anyone who applied it for the 21 October advisory. The post gives no technical root-cause detail.
TL;DR Flags a PHP code execution bug not fixed by the PHP2Shell patches, limited to a session serialize handler switch, mitigated by disabling session upload progress.
CVEs named here
Techniques named here
- Code execution through PHP session handling
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup