CVE-2026-115560: 
PHP analisi e mitigazione delle vulnerabilità

CVE-2026-115560 is a remote code execution (RCE) vulnerability in PHP affecting applications that use session upload progress tracking in combination with specific non-default session configuration changes. Disclosed on October 23, 2026, the CVE is currently in "Reserved" status with no official patch available as of the disclosure date. The PHP project has characterized it as a lower-severity issue requiring an unusual runtime configuration to exploit, though community coverage has been significant given its proximity to the emergency "PHP2Shell" patches (CVE-2026-109618/CVE-2026-109619) released two days prior. The CVSS category is estimated as HIGH (Feedly, BleepingComputer, PHP.net).

The vulnerability (CWE classification not yet formally assigned) stems from improper handling of PHP's session upload progress serialization feature (session.upload_progress). When an application enables session upload progress tracking and simultaneously applies specific non-default session configuration changes (such as altering the session serializer), attacker-controlled data written into the session upload progress key can be deserialized or evaluated as PHP code (SecurityOnline, BleepingComputer). The attack vector is network-accessible and requires no authentication, but exploitation is contingent on the target application running this unusual combination of session settings, which limits the affected population (Feedly, Dev.to Analysis). A reference to a potential exploit entry has appeared on Sploitus and Vulners, suggesting early-stage PoC research (Sploitus, Vulners).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary PHP code on the affected server, resulting in full compromise of confidentiality, integrity, and availability of the affected application and potentially the underlying host. An attacker achieving code execution could deploy web shells, exfiltrate sensitive data, pivot to internal network resources, or install persistent backdoors. The scope is limited to PHP applications running the specific combination of session upload progress enabled with non-default session serializer configuration, reducing the overall attack surface compared to the broader PHP2Shell vulnerabilities (Feedly, BleepingComputer).

As of the disclosure date, no confirmed public proof-of-concept exploit has been released, and there is no evidence of active in-the-wild exploitation (Feedly). However, entries have appeared on Sploitus and Vulners referencing a GitHub-sourced exploit identifier, indicating early PoC research activity (Sploitus, Vulners). No threat actor attribution has been reported, and the CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score has not yet been published. The vulnerability's requirement for an unusual configuration combination significantly reduces the realistic exploitable population, though the heightened attention following the PHP2Shell emergency patches increases the likelihood of targeted research (TheHackerNews, CriticalPathSecurity).

1. Reconnaissance: Identify PHP applications with session upload progress enabled (session.upload_progress.enabled = On) and a non-default session serializer (e.g., session.serialize_handler = php_serialize or similar) using passive fingerprinting or active probing of HTTP responses and error messages.
2. Confirm configuration: Send a crafted multipart file upload request with the PHP_SESSION_UPLOAD_PROGRESS field set; observe whether the server processes and stores the upload progress data in the session, confirming the vulnerable configuration is active.
3. Inject malicious payload: Craft a multipart POST request where the PHP_SESSION_UPLOAD_PROGRESS value contains a serialized PHP payload (e.g., a PHP object or code string) designed to be evaluated when the session data is deserialized under the non-default serializer.
4. Trigger deserialization/evaluation: Send a follow-up request that causes the PHP session to be read and the malicious session data to be deserialized or evaluated, resulting in arbitrary PHP code execution on the server.
5. Achieve objective: Use the code execution to deploy a web shell, establish a reverse shell, or exfiltrate data from the compromised server (SecurityOnline, Dev.to Analysis, BleepingComputer).

• Network: Unusual multipart POST requests containing PHP_SESSION_UPLOAD_PROGRESS fields with serialized or encoded PHP payloads; outbound connections from the web server process to unexpected external IPs following file upload requests.
• Logs: Web server access logs showing repeated multipart POST requests to upload endpoints with abnormally large or encoded PHP_SESSION_UPLOAD_PROGRESS values; PHP error logs referencing deserialization errors or unexpected object instantiation.
• File System: Newly created PHP files (web shells) in web-accessible directories, particularly following upload activity; unexpected modification of session files in the session storage directory (e.g., /tmp/sess_*) containing serialized PHP objects.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget, python, nc); unexpected outbound network connections initiated by the web server user account (BlackHillsInfoSec, BleepingComputer).

No patch is currently available; PHP has indicated a full fix will be included in the next regular update release (PHP.net, BleepingComputer). The primary recommended workaround is to disable session upload progress tracking by setting session.upload_progress.enabled = Off in php.ini; applications that do not require upload or download progress monitoring should apply this immediately (Feedly, 4sysops). Additionally, administrators should audit their session serializer configuration and revert to the default (session.serialize_handler = php) if non-default serializers are not required. WAF rules targeting malicious PHP_SESSION_UPLOAD_PROGRESS payloads can provide an additional layer of defense (Cloudflare, CERT-EU).

The disclosure generated significant community discussion, largely in the context of the PHP2Shell emergency patches released just two days prior, with many outlets framing CVE-2026-115560 as a third PHP vulnerability in rapid succession (TheHackerNews, Techaeris). Security researcher commentary on Mastodon and Bluesky (including from GossiTheDog) noted the unusual configuration requirement, with some analysts cautioning against overstating the risk (cyberplace.social/@GossiTheDog, Dev.to Analysis). CERT-EU and the Canadian Centre for Cyber Security (CCCS) both issued advisories, and Cloudflare published WAF protection guidance (CERT-EU, CCCS, Cloudflare). NVISO published operational guidance for defenders, and Black Hills Information Security released a SOC detection lab writeup (NVISO, BlackHillsInfoSec).