The vulnerability can be exploited when an application sets session.serializehandler to phpbinary or phpserialize in its configuration and then switches it to php at runtime with iniset(). This setup is unlikely in practice.
The vulnerability or weakness
The vulnerability can be exploited when an application sets session.serializehandler to phpbinary or phpserialize in its configuration and then switches it to php at runtime with iniset(). This setup is unlikely in practice.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | No | - |
| CVE-2026-109619 | 9.2 | CRITICAL | No | - |
| CVE-2026-115560 | n/a | not scored | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
Business impact
Organizations must apply the mitigation to avoid potential attacks, which could lead to data breaches or system compromise. The lack of a patch means the risk remains until a fix is released.
Industries affected
All industries are affected, as PHP is used by nearly 70% of websites on the internet, including e-commerce, finance, and content management systems.
Users affected
Website administrators and developers using PHP must implement the mitigation measures to protect their systems from potential exploitation attempts.
Build these skills
Watch the daily brief
Sources
- PHP shares mitigation for new RCE vulnerability with no patch (BleepingComputer)
