Remote Code Execution (RCE) Affecting php package, versions [5.4.0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-PHP-21700309
- published25 Oct 2026
- disclosed25 Oct 2026
- creditUnknown
Introduced: 25 Oct 2026
NewCVE-2026-115560 (opens in a new tab)How to fix?
There is no fixed version for php.
Overview
Affected versions of this package are vulnerable to Remote Code Execution (RCE) when session upload progress is enabled and the application configures session.serialize_handler as php_binary or php_serialize, then changes it to php at runtime using ini_set() before calling session_start().
Note:
Applications that never change the session serialization handler at runtime are not affected by this attack vector.
The issue can only occur under an unusual combination of configuration and application code.
Mitigation
Until a fixed version is available, users are advised to set session.upload_progress.enabled=0.
This setting was already listed as a mitigation for CVE-2026-109619
As information continues to emerge, we are actively investigating reports of this vulnerability affecting PHP. We will continue to update this advisory with confirmed findings and technical details, and add an official patch once available.