**PHP**, the open-source web development language powering nearly 70% of all websites, is grappling with a newly identified remote code execution (RCE) vulnerability. Tracked as **CVE-2026-115560**, this flaw currently lacks a security patch and requires a very specific, non-default configuration to be exploitable. According to **VirusTotal** estimates, over 5.1 million **PHP** hosts are exposed online, with approximately 3.8 million having at least one port open to potential attacks. ### Understanding CVE-2026-115560 The **PHP** security team's advisory on Friday detailed the niche conditions necessary for **CVE-2026-115560** to be exploited. An application must set `session.serialize_handler` to `php_binary` or `php_serialize` in its configuration, then dynamically switch it to `php` at runtime using `ini_set()` before calling `session_start()`. Additionally, `session.upload_progress.enabled` must also be active. Given this unusual combination of configuration and application code, the **PHP** team anticipates handling the patch in their regular release cycle. They state that applications not altering the serialize handler at runtime are not at risk. ### Mitigation Measures Until a patch is released, the recommended mitigation for **CVE-2026-115560** is to set `session.upload_progress.enabled=0`. This measure was previously advised for the **PHP2Shell** vulnerabilities, meaning systems that applied it earlier require no further action.  ### PHP2Shell Flaws Under Active Exploitation The revelation of **CVE-2026-115560** coincides with widespread exploitation attempts targeting the recently patched **PHP2Shell** vulnerabilities (**CVE-2026-109618** and **CVE-2026-109619**). Despite initial proof-of-concept (PoC) code being non-functional, security firms like **Cloudflare**, **watchTowr**, and **Hadrian** detected unsuccessful exploitation attempts even before public disclosure. This pre-patch activity followed a leak of some **PHP2Shell** details, including CVE IDs and mitigation advice, provided to critical infrastructure providers. **Amazon Threat Intelligence** reported that attackers began targeting **PHP2Shell** four days before the official patches were released. **CJ Moses**, **AWS** Chief Information Security Officer, noted varied payloads and anonymization infrastructure, suggesting multiple threat actors were involved. While the success rate of these early attempts is unclear, **Moses** confirmed that **PHP2Shell** is now facing broad exploitation attempts in the wild. Similarly, **Dataminr's Threat Research and Cyber Engineering (TRACE)** team observed scanning, fingerprinting, and the use of non-working exploits since disclosure. While no confirmed compromises have been reported, **TRACE** warns that functional PoCs and successful exploitation are likely imminent. This underscores the critical importance for administrators to ensure all **PHP** installations are promptly patched and configured securely.