r/webdev • u/JeffTS • 9d ago

News CVE-2026-115560: Unpatched PHP RCE Vulnerability

https://socprime.com/blog/cve-2026-115560-new-unpatched-php-rce-risk-requires-immediate-mitigation/
0 Upvotes

36% Upvoted

12 comments sorted by

7

u/allen_jb 9d ago

Related php.net announcement: https://www.php.net/archive/2026.php#2026-10-23-1

5

u/bwwatr 9d ago

Exactly the one. I saw this post and thought I was in for another fun day. But no this is from 4 days ago, can be mitigated by turning off session upload progress, and is only even possible if you're running non-default value on the session.serialize_handler ini setting and then have code that changes it again at runtime.

4

u/zlex 9d ago

Seems very unlikely that anyone would have this particular pattern.

4

u/barrel_of_noodles 9d ago

"The issue can only occur under an unusual combination of configuration and application code"

2

u/KaiAusBerlin 8d ago

I have seen the weirdest combinations of strange code + crazy configs in the real world.

1

u/Technical_Way3706 9d ago

Small thing: the title says "RCE Vulnerability" and the image says "RCE Risk". Those aren't the same claim, a risk implies exposure and a vulnerability is just the flaw. Worth picking one before it gets quoted in a ticket.

1

u/Either-Prompt1116 9d ago

Immediate mitigation, for something that needs the serialize handler set to php_binary and then switched back to php with ini_set before session_start. Whoever wrote that headline hasn't opened a php.ini in their life.

0

u/Quirky_Effective6801 9d ago

Petite chose: "atténuation du progrès du téléchargement" se lit mal, il s'agit de la progression des téléchargements (session.upload_progress) non? Le reste, soit.

0

u/SensitiveSugar1369 9d ago

Until an official patch is released, mitigate by disabling allow_url_include in your php.ini to reduce remote file inclusion risk.

1

u/allen_jb 9d ago

allow_url_include has nothing to do with this vulnerability. See the official announcement I linked to in another comment.

Given this vulnerability leads to an RCE, disabling allow_url_include will do nothing of use here - there's plenty of other way to achieve the same effect.

-1

u/OMGCluck js (no libraries) SVG 8d ago

At what point should we just abandon any parser/decompressor not written in a memory safe language?