Third PHP vulnerability discovered...Risk of remote code execution in certain environments

[Financial News] A new security vulnerability has been discovered in PHP, a programming language widely used on websites around the world. Systems may still be affected in certain environments even if emergency security patches addressing two previously identified vulnerabilities have been installed. However, no further action is needed if the previously recommended temporary measures have been applied.
According to the Korea Internet & Security Agency (KISA) on the 25th, the PHP development team disclosed on the 23rd (local time) a remote code execution (RCE) vulnerability (CVE-2026-115560) that occurs during session processing.
The flaw makes remote code execution possible under certain conditions and is not fixed by the security updates for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on the 21st.
However, the circumstances in which this vulnerability can occur are limited. According to the PHP development team, the vulnerability can occur only if a server is configured to store session data using 'php_binary' or 'php_serialize,' the method is then changed to 'php' while the program is running, and file upload progress tracking is also enabled.
The PHP development team said that this combination of settings is rare in actual production environments. It added that no further action is needed if file upload progress tracking has already been disabled to address the PHP2Shell vulnerability (CVE-2026-109619), disclosed on the 21st.
Also applications that do not change how session data is handled while running are not affected by this vulnerability, even if they leave file upload progress tracking enabled.
Accordingly, rather than releasing a separate emergency security patch, the PHP development team decided to fix the vulnerability in the next regular update and publish an official security advisory. The specific PHP versions affected and the versions that will fix the vulnerability have not yet been disclosed.
KISA also advised server operators in an additional security notice to disable file upload progress tracking in their server settings and restart all worker processes until an official security update is released. 
If these measures have already been applied while addressing the earlier vulnerability, operators can keep the existing settings without taking further action.

[email protected] Choi Hye-rim Reporter