Flash Report: New PHP Vulnerability Identified

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EDT) on October 26, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• On October 23, 2026, the PHP Foundation released an informational advisory warning users of a second way attackers could run code on web servers. This follows the October 21 emergency advisory, which identified two PHP2Shell flaws that allow attackers without account access to run code on servers.
• The latest vulnerability issue, assigned CVE-2026-115560, only affects a specific combination of configuration and application code. Since this is an unlikely setup, the PHP Foundation does not consider it a high risk and will mitigate it through its routine patch cycle.
• No exploitation of the latest flaw has been reported as of this writing. All known attacks targeting PHP since October 21, 2026, have been aimed at the two flaws reported on that date.
• PHP Foundation’s quick response has almost certainly mitigated the impact of the vulnerabilities it has disclosed over the past week. ZeroFox recommends following PHP Foundation guidance on patching all vulnerabilities disclosed. Any organizations with servers configured in such a way as to be vulnerable to the newly identified flaw should consult the latest PHP Foundation advisory for remediation steps.

Details

On October 23, 2026, the PHP Foundation released an informational advisory warning users of a second way attackers could run code on web servers.¹ This follows its October 21 emergency advisory, which identified two PHP2Shell flaws that allow attackers without account access to run code on servers.²

• PHP is an open-source, server-side scripting language first created in 1994 and maintained by the PHP Foundation.³
• It is used by roughly 70 percent of websites—including the WordPress content management system, which reportedly powers around 40 percent of all websites.⁴

The latest issue, assigned CVE-2026-115560, only affects a specific combination of configuration and application code. An application must have set “session.serialize_handler” to “php_binary” or “php_serialize” in its configuration and then be configured to switch it to PHP at runtime with “ini_set()” before calling “session_start()”. Session upload progress must also still be enabled.⁵

Since this is an unlikely configuration, the PHP Foundation does not consider this a high-risk vulnerability and will mitigate it through its routine patch cycle.

The PHP Foundation recommends setting session.upload_progress.enabled=0 until the next routine bugfix release to fully protect from an unlikely remote code execution vector.⁶ This is the same setting recommended for the initial flaws described in the October 21, 2026, emergency advisory.⁷

No exploitation of the latest flaw has been reported as of this writing. All known attacks targeting PHP since October 21, 2026, have been aimed at the two flaws reported on that date.⁸ It is likely that PHP Foundation’s decision not to publicly release a patch will mitigate the risk of attacks using the latest vulnerability, since such releases also alert threat actors to methods for exploitation.

Exploitation efforts targeting the first two vulnerabilities have surged since the public release on October 21.

• Cloudflare stated it detected a steep rise in the number of attack attempts, which increased from tens of thousands within 45 minutes of the initial October 21 disclosure to millions by the early morning on October 22.⁹

PHP Foundation’s quick response likely mitigated the impact of the vulnerabilities it has disclosed over the past week. There is a roughly even chance that the majority of large organizations have patched the vulnerabilities identified within the October 21 advisory and that the latest vulnerability requires such unique conditions it very likely poses no threat to the overwhelming majority of organizations.

ZeroFox assesses with moderate confidence that mass exploitation of unpatched PHP servers will almost certainly continue throughout at least the coming weeks, very likely driven by a remaining population of unpatched and end-of-life deployments that are likely most prevalent among smaller organizations without the capability for quick remediation. Initial activity is likely to consist of opportunistic scanning, web shell deployment, and credential theft, with initial access sales and follow-on ransomware activity likely to follow. ZeroFox assesses it is very likely that PHP2Shell will remain a long-tail exposure, as legacy systems that cannot be patched will persist for months, and further related disclosures are likely given the scrutiny now directed at the PHP codebase.

Recommendations

ZeroFox recommends following PHP Foundation guidance on patching all vulnerabilities it has disclosed. Additionally, any organizations with servers configured in such a way as to be vulnerable to the newly identified flaw should consult the PHP Foundation advisory for remediation steps.

1. hXXps://www.php[.]net/archive/2026.php#2026-10-23-1 ↩︎
2. hXXps://thehackernews[.]com/2026/10/urgent-php-warns-of-another-unpatched.html ↩︎
3. hXXps://thephp[.]foundation/ ↩︎
4. hXXps://fortune[.]com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/ ↩︎
5. hXXps://www.php[.]net/archive/2026.php#2026-10-23-1 ↩︎
6. Ibid. ↩︎
7. hXXps://thehackernews[.]com/2026/10/urgent-php-warns-of-another-unpatched.html ↩︎
8. Ibid. ↩︎
9. Ibid. ↩︎