Patched PHP isn't the end of it: a new flaw, hidden copies and leaked memory
New Zealand businesses that rushed to update PHP after this week's PHP2Shell disclosure have another problem. A related flaw, CVE-2026-115560, affects fully patched releases including PHP 8.5.12, according to Cloudflare. It won't be fixed until PHP's next regular release.
Cloudflare updated its blog to say the PHP project published an informational advisory for the flaw on 23 October. The bug is in PHP's session upload-progress feature. Cloudflare is the only source here for the advisory, and the details below are its account.
That feature has been in PHP since version 5.4.0 and is switched on by default, according to Recorded Future, citing VirusTotal. Recorded Future says some ways of exploiting the original PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, also run through it.
Cloudflare says its web application firewall (WAF) protects all customers against known exploit attempts, but only if their site uses PHP's default name for the upload-progress field. Sites that changed the session.upload_progress.name setting aren't covered by the rule. Cloudflare also says it has seen attackers changing their attack code to try to get past its protections.
Changing a setting won't close the gap. According to watchTowr, PHP says no configuration change fully mitigates these vulnerabilities.
