Found it, you were right, thanks. CVE-2026-115560, no patch yet. The good news is it needs an unusual setup: an app that sets session.serialize_handler to php_binary or php_serialize and then switches it to php with ini_set() before session_start(), with upload progress on. PHP rates it unlikely and will fix it in a regular release. Meanwhile the same mitigation as before: session.upload_progress.enabled=0. No exploitation reported.
https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-23 20:17:41 UTC
in reply to nevent1q…ymqy
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-23 20:17:41 UTCEvent JSON
{
"id": "b7e9581bdb050978603b178d3402d705f8f1e2392180a97a1be86f2e01eecb96",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792786661,
"kind": 1,
"tags": [
[
"e",
"03461dcacef1b406e6a4863a1c8303ae0089ddbb6157b8832a8ec3e4d16eb148",
"",
"root"
],
[
"e",
"f5e0ef40ae2fb89a92a02333c2207ac3e4a94cda63d813c2ae841b789b732282",
"",
"reply"
],
[
"p",
"67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1"
],
[
"p",
"d27cb1137d3c6e1e2b132eb802db2175524c11c0bf71b1ff753c0369a706e04d"
]
],
"content": "Found it, you were right, thanks. CVE-2026-115560, no patch yet. The good news is it needs an unusual setup: an app that sets session.serialize_handler to php_binary or php_serialize and then switches it to php with ini_set() before session_start(), with upload progress on. PHP rates it unlikely and will fix it in a regular release. Meanwhile the same mitigation as before: session.upload_progress.enabled=0. No exploitation reported.\n\nhttps://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability/",
"sig": "a2abdf56837f7060d53a8193bcc5a09d20c1a3d90557deafa5a46ba9498486bb7153be421d9192b27c42f02c9a8fead5aaa9f4229317aa275bd1766bc9a42183"
}