PHP veb-serverda kodni ishga tushirishning yana bir usuli haqida ogohlantirdi — bu PHP2Shell tanqidiy zaifliklari uchun shoshilinch tuzatishlar chiqarilganidan ikki kun o'tib sodir bo'ldi.
Yangi muammo, CVE-2026-115560, faqat g'ayrioddiy tarzda sozlangan veb-ilovalarga ta'sir qiladi va PHP buni ehtimoli past xavf deb hisoblaydi.
Loyiha bu muammo uchun shoshilinch tuzatish chiqarmaydi. Buning o'rniga, u keyingi odatiy relizda tuzatish mavjud bo'lguncha session upload progress deb nomlangan funksiyani o'chirishni tavsiya qiladi.
Ogohlantirish 23-oktabrda e'lon qilingan qisqa ma'lumotnomaviy maslahatda keltirildi. Bu 21-oktabrda chiqarilgan shoshilinch relizdan keyin sodir bo'ldi, unda hisob qaydnomasiz serverda kodni ishga tushirishga imkon beradigan ikkita tanqidiy PHP2Shell zaifligi — CVE-2026-109618 va CVE-2026-109619 — tuzatilgan edi. Ular PHP 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalarida tuzatildi. Yangi muammo alohida va bu relizlar bilan tuzatilmagan.
Faqat tor doiradagi sozlama xavf ostida. PHP aytishicha, muammo veb-ilova quyidagilarni barchasini bajarganda yuzaga kelishi mumkin: sozlamada session.serializehandler opsiyasini phpbinary yoki phpserialize ga o'rnatadi, keyin iniset() chaqiruvi orqali bu opsiyani ishlash jarayonida php ga o'zgartiradi va bu o'zgarishni session_start() chaqirilishidan oldin amalga oshiradi.
Shuningdek, session upload progress hali ham yoqilgan bo'lishi kerak. Ishlash jarayonida serialize handlerni o'zgartirmaydigan ilova bu funksiyani yoqilgan holda qoldirishi mumkin va bu yo'l orqali xavfga duchor bo'lmaydi. PHP aytishicha, bunday sozlama amalda kam uchraydi.
Chora bir qator. PHP keyingi odatiy xatolik tuzatish relizigacha session.upload_progress.enabled=0 ni o'rnatishni tavsiya qiladi. Bu 21-oktabrdagi CVE-2026-109619 uchun maslahatda allaqachon ko'rsatilgan o'sha sozlama.
O'shanda uni qo'llagan va o'rnatgan har kim yangi muammo uchun qo'shimcha hech narsa qilishi shart emas. Session upload progress sukut bo'yicha yoqilgan va ilovaga fayl yuklanish jarayonini kuzatish imkonini beradi.
Sozlama kam uchraydiganligi sababli, PHP tuzatishni odatiy reliz sikli doirasida, shoshilinch emas, amalga oshiradi va CVE-2026-115560 uchun to'liq maslahatni keyingi reliz bilan e'lon qiladi.
PHP qaysi versiyalar ta'sirlanganini, qaysi relizlar tuzatishni o'z ichiga olishini yoki jiddiylik bahosini aytmagan. Shuningdek, u yangi muammo CVE-2026-109619 bilan bir ildizga ega yoki yo'qligini ham aytmagan.
CVE-2026-115560 dan foydalanish haqida hech qanday xabar berilmagan; 21-oktabrdan keyin xabar qilingan hujumlar avvalgi ikkita PHP2Shell zaifligiga qaratilgan.
Alohida, avvalgi ikkita PHP2Shell zaifligidan foydalanish urinishlari keskin oshgan. Amazon aytishicha, uning honeypotlari zaifliklar e'lon qilinishidan to'rt kun oldin, 17-oktabrda CVE-2026-109618 va CVE-2026-109619 ga qarshi hujum urinishini qayd etgan, Cloudflare esa urinishlar 21-oktabr e'lonidan keyin 45 daqiqa ichida o'n minglabdan erta 22-oktabrga kelib millionlabga yetganini aytgan.
Sophos va Arctic Wolf ma'lumotiga ko'ra, hujumchilar zaifliklardan Mirai botnet variantini o'rnatish uchun foydalanishga urinishgan. Bu urinishlar hozircha muvaffaqiyatsiz: Previdian, Wordfence va boshqalar skanerlash va tekshirishni, lekin tasdiqlangan kod bajarilishini emas, xabar qilgan va tadqiqotchilar ishonchli eksploitni yaratish kutilganidan qiyinroq ekanligini aytishgan. Bu faoliyat 21-oktabrda tuzatilgan ikkita zaiflikka qaratilgan, hujum ostida ekanligi xabar qilinmagan CVE-2026-115560 ga emas.
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.
The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.
The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called session upload progress until a fix is available in the next routine release.
The warning came in a short informational advisory published on October 23. It follows the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server. Those were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The new issue is separate and is not fixed by those releases.
Only a narrow setup is at risk. PHP says the problem can occur when a web application does all of the following: sets the session.serializehandleroption to phpbinary or phpserialize in its configuration, then changes that option to php while running by calling iniset(), and makes that change before it calls session_start().
Session upload progress must also still be turned on. An application that never changes the serialize handler while running can leave the feature on and is not exposed through this path. PHP says this setup is unlikely in practice.
The action is one line. PHP recommends setting session.upload_progress.enabled=0 until the next routine bugfix release. This is the same setting it already listed as a mitigation in the October 21 advisory for CVE-2026-109619.
Anyone who applied it then and left it in place needs to do nothing more for the new issue. Session upload progress is turned on by default and lets an application track the progress of a file upload.
Because the setup is uncommon, PHP is handling the fix as part of its regular release cycle rather than as an emergency, and it will publish a full advisory for CVE-2026-115560 with the next release.
PHP has not stated which versions are affected, which releases will contain the fix, or a severity score. It also has not said whether the new issue shares a root cause with CVE-2026-109619.
No exploitation of CVE-2026-115560 has been reported; the attacks reported since October 21 target the two earlier PHP2Shell flaws.
Separately, attempts to exploit the two earlier PHP2Shell flaws have surged. Amazon said its honeypots logged an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days before the flaws were disclosed, and Cloudflare said attempts rose from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22.
Attackers have tried to use the flaws to install a Mirai botnet variant, according to Sophos and Arctic Wolf. Those attempts have so far failed: Previdian, Wordfence and others report scanning and probing but no confirmed code execution, and researchers say a reliable exploit is proving harder to build than expected. That activity targets the two flaws patched on October 21, not CVE-2026-115560, which has not been reported under attack.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.