# PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After Emergency PHP2Shell Patches (CVE-2026-109618/CVE-2026-109619)

> PHP warned of another unpatched remote code execution flaw (CVE-2026-115560) on October 23, two days after emergency patches for the PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619). The PHP2Shell flaws are under mass exploitation, with attempts to install Mirai botnet variants; CVE-2026-115560 has not been reported under attack and has no patch yet.

- **Published:** 2026-10-23T11:56:04Z
- **Last reviewed:** 2026-10-28T00:29:28.048Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4262
- **ID:** TL-2026-4262
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 159 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-115560, CVE-2026-109618, CVE-2026-109619

## Description

On October 21, 2026 the PHP project shipped emergency releases (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) for two critical, unauthenticated remote code execution vulnerabilities collectively named PHP2Shell. CVE-2026-109618 (RCE via OOM corruption) arises because out-of-memory handling can interrupt PHP while internal request data is only partially initialized, so request cleanup treats invalid data as valid. CVE-2026-109619 (RCE via stale global state, GHSA-6wmf-4rv5-p3rp) arises because request-owned internal state survives after its backing memory is freed; a later request handled by the same worker can use that stale state before initialization resets it, yielding heap use-after-free, memory disclosure and RCE. Fatal errors or warnings on attacker-reachable paths (invalid INI diagnostics, session upload progress during file uploads) can leave the stale references. Both carry CVSS v4.0 9.2 (GHSA vector for CVE-2026-109619: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). All PHP installations serving web requests are affected (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed), with highest risk for mod_php where an unauthenticated request can trigger the attack. Backports exist for PHP 7.4, 8.0 and 8.1; VirusTotal counted over 5.1 million exposed PHP hosts.

Details leaked on Hacker News on October 20, before the embargo ended; technical analyses and demonstrations against WordPress, Drupal and Joomla followed on October 21. Per The Hacker News, the first attack was seen on October 17 on Amazon honeypots, exploit attempts rose from tens of thousands within 45 minutes of the October 21 disclosure to millions by October 22 (Cloudflare), and Sophos and Arctic Wolf reported attempts to install Mirai botnet variants. watchTowr reported exploitation in its honeypot network on October 21. No confirmed code execution was reported; a reliable exploit is harder to build than expected. VulnCheck found code execution works on ARM64 and x86 systems without ASLR, but very few exploits work and none bypass ASLR on x86-64.

On October 23, 2026 PHP published an informational advisory for CVE-2026-115560, a session upload progress issue leading to RCE. It requires session.serialize_handler to be set to php_binary or php_serialize, the application to switch it to php at runtime via ini_set() before session_start(), and session.upload_progress.enabled to remain on. PHP calls this setup unlikely in practice. No CVSS, affected-version list or CWE is stated for it, it is unpatched (fix planned for the next routine bugfix release), and no exploitation is reported. Severity here is an analyst assessment driven by the actively exploited sibling flaws; the CVSS 9.2 applies to the PHP2Shell CVEs, not to CVE-2026-115560.

No network IOCs (IPs, domains, hashes) have been published by the sources reviewed (Huntress and Tanium both state none are established), so BeaconBeagle correlation was not applicable. Indicators below are behavioral and configuration based.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1053.003 Cron
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1499.004 Application or System Exploitation
- T1592.002 Gather Victim Host Information
- T1105 Ingress Tool Transfer
- T1588.005 Obtain Capabilities
- T1090.003 Proxy
- T1059.003 Command and Scripting Interpreter
- T1059.001 Command and Scripting Interpreter
- T1059.006 Command and Scripting Interpreter
- T1005 Data from Local System
- T1136 Create Account
- T1003 OS Credential Dumping
- T1557 Adversary-in-the-Middle
- T1087 Account Discovery
- T1588.006 Obtain Capabilities
- T1203 Exploitation for Client Execution
- T1552.001 Unsecured Credentials
- T1003.008 OS Credential Dumping
- T1557.001 Adversary-in-the-Middle
- T1087.002 Account Discovery
- T1572 Protocol Tunneling
- T1212 Exploitation for Credential Access
- T1608.001 Stage Capabilities
- T1041 Exfiltration Over C2 Channel
- T1499.002 Endpoint Denial of Service: Service Exhaustion Flood

## Sources

- [PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches](https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html)
- [PHP.net security announcements, October 2026](https://www.php.net/archive/2026.php#2026-10-23-1)
- [GHSA-6wmf-4rv5-p3rp: RCE via Stale Global State (CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [GHSA-w8hw-w9fx-j79w: RCE via OOM Corruption (CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- [PHP ships emergency patches for critical PHP2Shell flaws](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws)
- [Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities](https://huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities)
- [CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Two Critical PHP Remote Code Execution Flaws](https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-109618-and-cve-2026-109619-php2shell)
- [PHP2Shell: Responding to CVE-2026-109618 and CVE-2026-109619](https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619)
- [Help Net Security: PHP2Shell PHP vulnerabilities patched](https://helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4262