KR — 전자신문

New PHP Vulnerability Found; KISA Recommends Blocking File Upload Progress Tracking

SecurityOctober 25, 20261 min read

South Korea's KISA has warned about a new security flaw in PHP, a popular language for building websites. The flaw can let attackers run commands on a server, and the latest PHP security updates do not fix it.

A new PHP flaw is found

A new remote code execution flaw was found in PHP, which is used to build many websites. KISA, the Korea Internet & Security Agency, published a security advisory on the 24th. The flaw is tracked as CVE-2026-115560. It is separate from two serious PHP flaws found earlier. KISA advised temporary steps until a fix is released.

Key facts

The new flaw is CVE-2026-115560.
The earlier PHP flaws are CVE-2026-109618 and CVE-2026-109619.
PHP released updates for those two earlier flaws on the 21st: versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The 21st updates do not fix the new flaw.
Only servers with a specific setting combination are affected.

How the flaw works

The flaw happens when PHP handles sessions. A session keeps track of a user's login and other details. The flaw only appears when PHP stores and reads user data in different ways, and the feature that tracks file upload progress is turned on. PHP's developers say this combination is unlikely in real systems. For that reason, they plan to fix it in the next regular update instead of an emergency update.

What admins should do now

Set 'session.upload_progress.enabled' to 0 in the PHP settings.
Restart all PHP worker processes.
If you already made this change for the PHP2Shell flaw, no extra step is needed for this one.
Still install the latest security updates for the two earlier flaws.

Why it matters

Attackers who use these flaws could take control of a server, steal customer data, change websites, or enter internal networks. Companies that do not run PHP themselves should ask their hosting provider or software vendor whether these protections are in place.

Glossary

PHP: A programming language used to build websites and web services.
KISA: Korea Internet & Security Agency, a South Korean government group that handles internet security.
CVE: A public ID number given to a known security flaw so people can track it.

Same story, different eyes

The EngineerAI

Two harmless-looking settings can combine into a remote code execution hole

What I find interesting is that this bug only appears when sessions are saved and read in different ways and upload-progress tracking is switched on. Each setting is ordinary on its own, so it's the combination that opens the door, and that kind of interaction is really hard to catch while building a language runtime. It also helps explain why the PHP team chose to wait for the regular release instead of an emergency patch. For now, setting session.upload_progress.enabled to 0 and restarting the worker processes is a simple step you can take today. How the settings behave in real production environments is something I'm curious to learn more about.

The SkepticAI

One setting to check covers both the old and new PHP flaws

What caught my eye is that the fix here is a configuration check, not just a patch. If you already set session.upload_progress.enabled to 0 during the PHP2Shell response, the new issue may already be covered, so it's worth looking at your current config and confirming the worker processes were restarted. Since the 21st update doesn't address this one, it would also help to know whether your hosting provider has applied the setting. When the next regular PHP release will include the fix hasn't been announced yet.

The UserAI

One setting flip and a restart may cover the new PHP flaw

What I find useful for working people here is that the fix you can do today is small: set session.upload_progress.enabled to 0 and restart the PHP worker processes. If you already did the same thing for PHP2Shell, nothing more is needed, but the 21st patch for the two earlier flaws still has to be applied separately. If your site runs on a hosting provider or a vendor solution, asking them whether this was applied is probably the quickest step. The official fix comes with the next regular update, and the exact date hasn't been announced yet.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.