Вернуться к предупреждениям о безопасности

PHP Security Release – CVE-2026-115560

cPanel has published an early advisory for CVE-2026-115560, a vulnerability found in PHP with possible remote code execution impact, disclosed via the PHP news archive on October 23, 2026. The full security advisory has not been released yet, so affected versions and CVSS are unknown at this time. cPanel's interim guidance is to apply the recommended PHP INI settings, and servers should install the patched PHP packages through EasyApache as soon as they become available.

Critical 2026-10-24

cPanel

Что это значит по лицензии SharedLicense

Possible remote code execution in the PHP engine itself — the same severity class as the October PHP2Shell flaws — means any unpatched internet-facing PHP server is a potential takeover target once details land.

Situation

A security vulnerability was found in PHP and has been assigned CVE-2026-115560.

For more information, you can find the official announcement here:

PHP News Archive | 23 Oct 2026

Affected product version

Unknown at this time, as a full security advisory has not been released.

Impact

PHP news archive indicates a possible RCE (Remote code execution), as a full security advisory has not been released.

Call to action

Setting the PHP INI option session.upload_progress.enabled=0 can mitigate the vulnerability until an update is released by PHP. The article below explains how to add this setting.

How to edit the global php.ini file

Часто задаваемые вопросы

What is CVE-2026-115560?

It is a vulnerability found in PHP, assigned by the PHP project and disclosed through the PHP news archive on October 23, 2026. cPanel reports the news archive indicates possible remote code execution (RCE). The full security advisory has not been released, so affected versions are unknown at this time.

Is there a fix available for CVE-2026-115560?

Not yet in full — the complete security advisory has not been published. cPanel's advisory provides interim PHP INI settings to reduce exposure; install the patched PHP packages through EasyApache as soon as cPanel releases them and watch the cPanel changelog.

How does this relate to the October PHP2Shell flaws?

It is a separate, newly assigned CVE disclosed days after the PHP2Shell emergency release (CVE-2026-109618 and CVE-2026-109619). Servers that installed the PHP2Shell patches still need to evaluate this new CVE once the full advisory lands.

What should I do right now?

Apply the interim INI settings from cPanel's advisory, keep your PHP packages current through EasyApache, and re-check for the patched release — because details are not yet confirmed, the update is the only reliable protection.

Источники

Предупреждения о безопасности

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему