PHP has issued an informational advisory about a second remote code execution path tied to session upload progress, just two days after emergency patches for the critical PHP2Shell flaws. The new path is not fixed by the 21 October releases that addressed CVE-2026-109618 and CVE-2026-109619, according to Cyber Recaps' summary of the advisory.

A narrow but real configuration path

The issue requires an unusual combination: the session serialize handler set to php_binary or php_serialize, then switched at runtime via ini_set() to php before session_start(), while session upload progress remains enabled, which is its default. Most applications that never alter the handler at runtime are not exposed through this path. PHP has not listed specific affected versions for the new advisory, and no exploitation of this new path has been reported.

Context: the PHP2Shell scramble

The earlier PHP2Shell flaws, disclosed on 20 October, drew a warning from the US National Security Agency's Cybersecurity Collaboration Center and reports of thousands of exploit attempts observed by Cloudflare, with attackers adapting tactics to bypass protections. The fixes landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and earlier reporting said attacks had surged quickly after disclosure without confirmed successful code execution in the wild. Operators who already patched PHP2Shell should still review the new advisory, because the session-upload-progress path sits outside those fixes.

Sources: PHP advisory as summarised by Cyber Recaps; USA Today PHP2Shell reporting.