CVE-2026-115560

Record from cert-ca · Published October 21, 2026

Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting PHPFootnote 1. In response to the vendor advisory, the Cyber centre released an advisory on October 21, 2026Footnote 2. Tracked as CVE-2026-109618Footnote 3 and CVE-2026-109619Footnote 4, these vulnerabilities are Use After Free vulnerabilities (CWE-416)Footnote 5 affecting multiple versions of PHP. Known as “php2shell”Footnote 6, successful exploitation could allow an unauthenticated threat actor to execute arbitrary code on an affected system. Internet-facing PHP servers and applications are at heightened risk. The PHP Security Team has released security updates addressing these vulnerabilities. Organizations should identify affected systems and apply the appropriate updates immediately. PHP remains a widely deployed technology and continues to support a substantial proportion of web applications worldwide. All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows an unauthenticated request to trigger the vulnerability before application-level code is executed. The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly. Update 1 On October 23, 2026, the PHP Security Team published additional information regarding another remote code execution vulnerabilityFootnote 9, tracked as CVE-2026-115560Footnote 10. The vulnerability is not addressed by the security updates released on October 21, 2026. Successful exploitation of CVE-2026-115560 requires an uncommon combination of PHP configuration and application behaviour. Applications that do not change the serialization handler at runtime are not exposed to this attack vector. Until a security update is available, the PHP Security Team recommends disabling the session upload progress feature: session.upload_progress.enabled=0 This mitigation was previously recommended for CVE-2026-109619. Organizations that have already applied this mitigation and kept it in place do not need to take additional action specifically for CVE-2026-115560. Update 2 Open-source reporting indicates that CVE-2026-109618 and CVE-2026-109619 are being exploited in the wild. On October 26, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618Footnote 11 and CVE-2026-109619Footnote 12 to their Known Exploited Vulnerabilities (KEV) Database. Suggested actions The Cyber Centre strongly recommends that organizations running affected PHP versions upgrade to the following fixed version: affected PHP versions upgrade Affected Product Affected Versions Fixed Versions PHP 8.5.x prior to 8.5.12 8.5.12 PHP 8.4.x prior to 8.4.27 8.4.27 PHP 8.3.x prior to 8.3.36 8.3.36 PHP 8.2.x prior to 8.2.35 8.2.35 Note: versions 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version. The Cyber Centre recommends that organizations: Update affected PHP installations immediately to a fixed, supported release. Prioritize Internet-facing systems and applications that process untrusted input. Identify third-party products, appliances and containers that include vulnerable PHP componentsFootnote 7. Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied. Monitor for potential compromise by reviewing web server, application, authentication, and endpoint logs for suspicious activity. Investigate unexpected processes, commands, files, accounts or outbound connections associated with PHP or web-server services. Continuously monitor third-party vendors for security updates, including appliances, applications and services that bundle PHP, and apply applicable patches without delay. Organizations should also review the Cyber Centre’s Top 10 IT Security ActionsFootnote 8. Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca. References Footnote 1 Security advisory: Critical remote code execution vulnerabilities, update now Return to footnote1 referrer Footnote 2 PHP security advisory (AV26-1070) Return to footnote2 referrer Footnote 3 CVE-2026-109618 Detail Return to footnote3 referrer Footnote 4 CVE-2026-109619 Detail Return to footnote4 referrer Footnote 5 CWE-416: Use After Free Return to footnote5 referrer Footnote 6 PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Return to footnote6 referrer Footnote 7 php2shell/software/software_list.md at main - NCSC-NL/php2shell - GitHub Return to footnote7 referrer Footnote 8 Top 10 IT security actions to protect Internet connected networks and information (ITSM.10.089) Return to footnote8 referrer Footnote 9 PHP: News Archive - 2026 Return to footnote9 referrer Footnote 10 CVE-2026-115560 Detail Return to footnote10 referrer Footnote 11 New CISA KEV: CVE-2026-109618 Return to footnote11 referrer Footnote 12 New CISA KEV: CVE-2026-109619 Return to footnote12 referrer