SB2026102365 - Remote code execution in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102365

SB2026102365 - Remote code execution in PHP

Published: October 23, 2026

Security Bulletin ID SB2026102365
CSH Severity
High
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-115560)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an incomplete fix for #VU156712 (CVE-2026-109619). A remote attacker under certain condition can still bypass implemented user-after-free protections and execute arbitrary code on the system.

As per official PHP advisory: 

The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. 


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References