PHP Just Warned of Another Unpatched RCE Risk — Two Days After the PHP2Shell Emergency Patch

 

PHP Just Warned of Another Unpatched RCE Risk — Two Days After the PHP2Shell Emergency Patch

**By a Technology Analyst & Business News Writer | October 23, 2026**

---

## The Second Alert Nobody Wanted to See

Let me tell you about a week that has shaken the foundations of the internet.

On **Tuesday, October 20, 2026**, the PHP security team did something it almost never does. It issued an advance warning of a critical security release — a heads-up that two vulnerabilities in the PHP programming language were so severe that patches would drop in less than 48 hours, and everyone needed to get ready .

The vulnerabilities were tracked as **CVE-2026-109618** and **CVE-2026-109619** — collectively nicknamed **PHP2Shell**. Both were rated **CVSS 9.2 out of 10**. Both allowed **unauthenticated remote code execution** — meaning an attacker could take over a server without even logging in .

Then, on **Friday, October 23, 2026** — just two days after the emergency patches went live — PHP issued another advisory. A **third vulnerability**, tracked as **CVE-2026-115560**. Another remote code execution risk. And this time, **no emergency patch** .

For the millions of Americans who run websites, manage servers, or simply use the internet every day, this is a moment that demands attention. Because the software at the center of this storm — PHP — powers roughly **70% of the web** .

---

## What Is PHP2Shell? The Flaw That Broke the Internet's Assumptions

Let me break this down in plain English, because the technical details matter.

### The Basics

PHP is a programming language that runs on the **server side** — it's what makes websites dynamic. WordPress, which powers over 40% of all websites, runs on PHP. So does Magento, Drupal, and countless custom applications .

The PHP2Shell vulnerabilities weren't flaws in any specific application. They were flaws in **PHP itself** — the core engine that processes every web request .

That distinction is crucial. It means **even a perfectly secure website was at risk** if it ran on a vulnerable version of PHP. The attacker didn't need to find a bug in your code. They just needed to send a specially crafted request to your server .

### How the Attack Works

Both vulnerabilities exploited how PHP handles memory when something goes wrong during request processing.

**CVE-2026-109618** was triggered by exhausting PHP's memory. When a request consumed too much memory, PHP's cleanup process could leave behind improperly initialized data. An attacker could then manipulate that leftover data to execute code .

**CVE-2026-109619** was subtler. It involved "stale state" — references to memory that had already been released. When a PHP worker process handled a later request, it could follow those outdated references and access memory it shouldn't. That could expose sensitive data or allow code execution .

The result? An attacker could potentially read passwords, API keys, and session tokens from other users' requests. Or they could run their own code on your server .

### The Scale of the Threat

The numbers are staggering.

According to VirusTotal, there were approximately **5.1 million IP addresses running PHP** as of October 21, 2026. Of the ones that disclosed their version, roughly **four in five were running an end-of-life branch** — meaning they wouldn't receive an official patch .

Modat, another scanner, counted **4.38 million PHP services on 1.89 million unique hosts**. About **79%** were running a version PHP no longer supports .

And here's the part that should worry every American business owner: **PHP 8.2 reaches end of life on December 31, 2026**. That's in two months. If you're running PHP 8.2, you need to upgrade to 8.3 or later before the end of the year, or you'll be running unsupported software .

---

## The Emergency Response: What Happened on October 21

The PHP team didn't sit on this. They moved fast.

### The Patches

On **October 21, 2026**, PHP released fixed versions:

- **PHP 8.5.12**

- **PHP 8.4.27**

- **PHP 8.3.36**

- **PHP 8.2.35**

For older versions — PHP 7.4, 8.0, and 8.1 — the team published **source code backports**, but no official binary releases. Those branches are end-of-life and no longer officially supported .

### The Chaos in Europe

The disclosure triggered an extraordinary response across Europe.

Several Dutch websites — including **Tweakers**, the **House of Representatives**, **NCSC-NL**, and **Security.NL** — went offline on October 21 as a precaution . National CERTs including the **UK NCSC** and **CERT Polska** advised organizations to consider taking unpatched PHP services offline entirely .

The **EU's CERT-EU** issued a warning urging immediate patching, and said that if patching wasn't possible, websites should be taken offline .

Even the underground felt the heat. The forum **PwnForums** went down for what a Telegram channel described as "PHP bug maintenance." The darknet forum **Dread** and **Kiwi Farms** were also reportedly affected .

### The Exploitation Rush

Cloudflare deployed WAF protections **nine hours ahead of public disclosure**, and by October 22, the company reported that exploit attempts had reached **millions** .

Sophos and Arctic Wolf reported attempts to exploit the vulnerabilities to install a **Mirai botnet variant** — though those attempts had not succeeded as of the latest reporting .

KELA Cyber assessed with **moderate confidence** that no successful compromise attributable to these CVEs had been established yet. But the firm warned that the barrier to reliable exploitation is likely to fall as researchers analyze the patches .

---

## The New Flaw: CVE-2026-115560

Now let's talk about the second advisory that landed on Friday.

### The Specific Conditions

CVE-2026-115560 is a **potential remote code execution** vulnerability, but it requires a very specific — and rare — configuration.

According to PHP's advisory, an application is only exposed if **all three** of the following conditions are met :

**First**, the application's configuration sets `session.serialize_handler` to `php_binary` or `php_serialize`.

**Second**, the application's code changes that setting to `php` at runtime using `ini_set()` before calling `session_start()`.

**Third**, the `session.upload_progress` feature is enabled.

Only the third condition is common — `session.upload_progress` is enabled by default. But changing the session serialization format at runtime is extremely rare. PHP itself describes the scenario as **"improbable"** .

### The Good News

For most organizations, **this new flaw doesn't change anything**.

If you applied the PHP2Shell patches on October 21 and left them in place, you're likely already protected — because the mitigation PHP recommends for CVE-2026-115560 is the same one it recommended for PHP2Shell: disable `session.upload_progress.enabled` .

If you only updated PHP but didn't apply that mitigation, you should do it now. The fix is a one-line change in `php.ini`:

`session.upload_progress.enabled=0`

Then restart every PHP worker process .

### The Bigger Picture

CVE-2026-115560 is a reminder that **PHP2Shell wasn't the end of the story**. The patches closed two critical doors. But the underlying complexity of PHP — and the ways applications configure it — creates ongoing risk.

Researcher **Andrew Dorman** separately reported session-handling flaws that he claims survive in PHP 8.5.12, including object injection and conditional remote code execution under specific configurations. Those findings haven't been confirmed by PHP or independently verified .

The lesson: **Patching is necessary. But it's not sufficient.** Configuration matters. And for anyone running PHP, the work of securing it is never finished.

---

## What This Means for American Businesses and Website Owners

Let me bring this down to earth. What should you actually do?

### If You Run a Website

**First, check your PHP version.** If you're on PHP 8.2, 8.3, 8.4, or 8.5, you need to be on the patched releases: **8.2.35, 8.3.36, 8.4.27, or 8.5.12** .

**Second, restart your web server.** Installing the patched package doesn't load the patched runtime into running processes. You need to restart Apache, PHP-FPM, and every long-running PHP worker .

**Third, apply the upload progress mitigation.** Even after patching, set `session.upload_progress.enabled=0` in `php.ini` or your PHP-FPM pool configuration — not via `ini_set()` or `.user.ini`, which apply too late .

**Fourth, check your secrets.** If your server was exposed before patching, rotate any credentials that the PHP process could read — database passwords, API keys, session tokens .

### If You Use a Hosting Provider

**Ask them what version of PHP they're running.** If they can't tell you, or if they're running an end-of-life version, consider moving.

Most shared hosting providers manage PHP for you. But you should confirm that they've applied the October 21 patches and restarted their workers.

### If You Run WordPress or Another PHP Application

**The application code isn't the problem.** PHP2Shell and CVE-2026-115560 are flaws in the PHP runtime, not in WordPress or any plugin. Updating your plugins won't fix this. Only updating PHP will .

---

## Frequently Asked Questions (FAQs)

### Q1: What is PHP2Shell?

PHP2Shell is the nickname for two critical vulnerabilities in PHP — **CVE-2026-109618** and **CVE-2026-109619** — that allow unauthenticated remote code execution. They were patched on October 21, 2026. Both were rated CVSS 9.2 out of 10 .

### Q2: What is CVE-2026-115560?

CVE-2026-115560 is a **new, unpatched** remote code execution vulnerability disclosed on October 23, 2026. It requires a rare configuration: an application must change `session.serialize_handler` from `php_binary` or `php_serialize` to `php` at runtime while `session.upload_progress` is enabled. PHP describes the scenario as "improbable" .

### Q3: Do I need to worry about CVE-2026-115560 if I patched PHP2Shell?

**Probably not.** If you applied the PHP2Shell patches and disabled `session.upload_progress.enabled`, you're likely already protected against CVE-2026-115560, because the mitigation is the same .

### Q4: How do I fix PHP2Shell?

Update to **PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35**, then **restart your web server and PHP workers**. Also set `session.upload_progress.enabled=0` as a defense-in-depth measure .

### Q5: Is my website at risk if I use WordPress?

**Yes, if you're running an outdated PHP version.** The vulnerabilities are in PHP itself, not WordPress. Updating WordPress plugins won't fix it. You need to update PHP .

### Q6: What if I'm on shared hosting?

Ask your hosting provider what PHP version they're running and whether they've applied the October 21 patches. If they can't confirm, consider moving to a provider that can .

### Q7: What is PHP 8.2 end of life?

PHP 8.2 reaches **end of life on December 31, 2026**. After that date, it will receive no further security fixes. If you're on PHP 8.2, you should upgrade to 8.3 or later before the end of the year .

### Q8: How many servers are affected?

VirusTotal identified approximately **5.1 million IP addresses running PHP**. About **four in five** of those that disclosed their version were running an end-of-life branch that wouldn't receive an official patch .

---

## High-Value Keywords for Content Creators and AdSense Publishers

For bloggers, affiliate marketers, and AdSense publishers covering this story, here are the most profitable keywords to target:

### Tier 1: High CPC ($15+)

| Keyword | Estimated CPC | Search Volume |

|---------|--------------|---------------|

| Best web hosting for WordPress 2026 | $25-$40 | Very High |

| Best managed WordPress hosting | $20-$35 | Very High |

| How to update PHP version | $18-$30 | High |

| Best website security tools 2026 | $15-$25 | High |

| WordPress security plugin | $15-$22 | Very High |

### Tier 2: High Volume, Low Competition

| Keyword | Search Volume | Competition |

|---------|--------------|-------------|

| PHP2Shell vulnerability explained | Very High | Low |

| CVE-2026-115560 explained | High | Very Low |

| How to fix PHP2Shell | High | Low |

| Is my website vulnerable to PHP2Shell | High | Low |

| PHP 8.2 end of life upgrade guide | High | Low |

### Tier 3: Long-Tail Money Keywords

- "How to check my PHP version for PHP2Shell"

- "Best hosting providers that patched PHP2Shell"

- "What is session.upload_progress and why disable it"

- "PHP2Shell vs CVE-2026-115560 difference"

- "How to secure WordPress after PHP vulnerability"

---

## Conclusion: A Week That Exposed the Internet's Fragility

The PHP2Shell crisis and the immediate follow-up with CVE-2026-115560 tell a story about the modern internet that most Americans never see.

**The good news:** The PHP security team moved fast. Cloudflare deployed protections before the patches even went live. Governments and CERTs issued warnings. The ecosystem responded.

**The bad news:** The internet runs on software that is **fragile, complex, and often outdated**. Millions of servers are running end-of-life PHP versions that will never receive official patches. And the disclosure of one critical flaw often invites scrutiny that uncovers more.

For American businesses and website owners, the message is clear: **Patching is not optional.** It's not something you do when you get around to it. It's a fundamental security practice, as essential as locking your front door.

For American consumers, the message is simpler: **The websites you use every day depend on software you've never heard of.** And when that software has a flaw, the consequences can be enormous.

PHP powers 70% of the web. It just had one of its worst weeks in years. And the work of securing it is far from over.

---

## Disclaimer

This article is for informational and educational purposes only and does not constitute financial, technology, or security advice. The information contained herein is based on publicly available sources as of October 23, 2026. Software vulnerabilities and patches are subject to rapid change. The author and publisher are not responsible for any decisions made based on the information presented in this article. Always consult official PHP documentation and security advisories for the most current information.

---

**Tags**: #PHP #PHP2Shell #CVE2026109618 #CVE2026109619 #CVE2026115560 #CyberSecurity #WebSecurity #RCE #Vulnerability #PatchManagement #WordPress #WebHosting #TechNews #SecurityNews #PHP8 #Cloudflare #CISA #CERT #OpenAI #Wiz #Calif #AmericanBusinesses #WebsiteSecurity #TechAnalysis #DataProtection #InfoSec #CyberAttack #ZeroDay #SecurityPatch #WordPressSecurity #WebDev