What else needs attention?
On 23 October 2026, the PHP project disclosed another unusual RCE path involving Session Upload Progress. The 21 October security updates for the two original PHP2Shell CVEs do not close this additional attack path.
According to the PHP advisory, it requires a specific combination: a different session serialisation handler is configured, the application switches at runtime before the session starts to php, and Session Upload Progress is enabled. A domain-only or version-only check cannot identify this combination.
Which mitigation does the PHP project recommend?
The published advisory recommends using session.upload_progress.enabled=0until the next regular bugfix release. According to the advisory, operators who have already applied and retained this setting need no further change for this issue. Ask the hosting provider to verify the applicable configuration and future updates.
Original PHP project advisory ↗
The HANECS PHP version check assesses the minimum versions for CVE-2026-109618 and CVE-2026-109619. It explicitly does not declare CVE-2026-115560 fixed.
The original PHP2Shell briefing
The briefing on CVE-2026-109618 and CVE-2026-109619 contains the original patch levels and next steps for operators.
Assess website and version ↗Sources
- PHP Security Team: Session Upload Progress ↗
- Canadian Centre for Cyber Security: update of 23 Oct 2026 ↗
Information reviewed 26 October 2026. Editorial first orientation, not evidence of your actual server configuration.