CVE-2026-115560: PHP Web Server Code Execution Risk — Immediate Hardening Guide

Two days after shipping emergency fixes for the critical PHP2Shell vulnerabilities, the PHP project has issued a stark warning regarding a new, unpatched code execution vector: CVE-2026-115560. While the PHP team assesses this as an unlikely risk due to its reliance on non-default configurations, the proximity to the PHP2Shell emergency patch cycle means many administrators are already in a heightened state of alert — and potentially in a vulnerable posture if they are reconfiguring services in haste.

This is a Technical Threat affecting web server integrity. While no emergency patch is forthcoming, the risk of remote code execution (RCE) demands immediate defensive action. This guide provides the technical analysis, detection rules, and remediation steps required to secure your infrastructure against CVE-2026-115560.

Technical Analysis

Affected Products and Context

This vulnerability impacts PHP web applications configured in a specific, non-standard manner. The exact version numbers are not detailed in the initial disclosure, but the issue is classified as a code execution flaw. Unlike the recent PHP2Shell flaws which prompted emergency patches, PHP has explicitly stated they are not issuing an emergency fix for CVE-2026-115560 at this time. The vulnerability requires an unusual configuration to be exploitable, which significantly reduces the attack surface but increases the risk for legacy or highly customized environments.

How the Vulnerability Works

From a defensive perspective, the attack chain relies on a specific feature being enabled within the PHP configuration. While the summary redacts the specific feature name, the mitigation advice — "turning off a feature" — implies a configuration-based trigger. Exploitation would likely involve:

1. Reconnaissance: The attacker identifies a PHP application with the vulnerable configuration enabled.
2. Payload Delivery: A crafted HTTP request or input is sent to the server.
3. Execution: The vulnerable PHP feature processes the input, resulting in arbitrary code execution within the context of the web server user (typically www-data, apache, or nginx).

Exploitation Status

As of this writing, CVE-2026-115560 is theoretical and unpatched. There is no public Proof-of-Concept (PoC) code, no confirmed active exploitation in the wild, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the critical nature of code execution flaws, defenders must assume that threat actors are actively analyzing the disclosure to weaponize it before a patch is available.

Detection & Response

Since this is a technical threat involving potential code execution on web servers, proactive hunting is essential. The following rules are designed to detect the behavioral indicators of exploitation — specifically, the web server process spawning unexpected system commands.

---
title: PHP Process Spawning Suspicious Shell
description: Detects PHP-CGI or PHP-FPM processes spawning command interpreters, indicative of code execution exploitation attempts.
author: Security Arsenal
date: 2026/10/27
references:
  - https://attack.mitre.org/techniques/T1059/
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  service: auditd
detection:
  selection:
    parent_process_name:
      - 'php-fpm*'
      - 'php-cgi*'
      - 'php'
    process_name:
      - 'sh'
      - 'bash'
      - 'dash'
      - 'zsh'
      - 'python*'
      - 'perl'
      - 'ruby'
      - 'curl'
      - 'wget'
      - 'nc'
      - 'netcat'
  condition: selection
falsepositives:
  - Legitimate administrative scripts running via cron or CLI
  - Some monitoring agents that wrap PHP calls
level: high
---
title: Web Server Spawning System Commands
description: Detects the web server user or process executing system binaries, a common indicator of RCE.
author: Security Arsenal
date: 2026/10/27
references:
  - https://attack.mitre.org/techniques/T1059/
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  service: auditd
detection:
  selection:
    user:
      - 'www-data'
      - 'apache'
      - 'nginx'
    process_name:
      - 'id'
      - 'whoami'
      - 'uname'
      - 'cat'
      - 'ls'
      - 'pwd'
      - 'ifconfig'
      - 'ip'
  condition: selection
falsepositives:
  - Legitimate health checks or poorly coded applications
level: medium

// Hunt for PHP/Web Server Spawning Shells in Microsoft Sentinel
let WebUsers = dynamic(["www-data", "apache", "nginx"]);
let SuspiciousProcs = dynamic(["sh", "bash", "dash", "zsh", "python", "perl", "curl", "wget", "nc", "netcat", "id", "whoami", "uname"]);
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName in~ (SuspiciousProcs)
| where SyslogMessage has "php" or Computer in (
    Syslog
    | where TimeGenerated > ago(24h)
    | where ProcessName has_any ("php-fpm", "php-cgi", "apache", "nginx")
    | summarize by Computer
)
| extend ParentProcess = extract(@"PPID=(\d+)", 1, SyslogMessage)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, ParentProcess
| order by TimeGenerated desc

-- Velociraptor Hunt: PHP Process Spawning Suspicious Children
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Ppid
FROM pslist()
WHERE (Name =~ 'php' OR Exe =~ 'php') 
  AND (CommandLine =~ 'sh|bash|python|perl|curl|wget|nc' OR Name =~ 'sh|bash|python|perl')
ORDER BY CreateTime DESC

Remediation Script

Since no patch is available, remediation relies on configuration hardening. This script audits common PHP configuration locations for potentially dangerous function usage and attempts to disable the system function (a common vector for such code execution flaws) if not explicitly required. Test this in a staging environment first.

#!/bin/bash
# CVE-2026-115560 Hardening Script
# Disables dangerous PHP functions to mitigate potential RCE vectors.

INI_PATHS=("/etc/php.ini" "/etc/php/*/cli/php.ini" "/etc/php/*/fpm/php.ini" "/usr/local/lib/php.ini")
BACKUP_DIR="/root/php_backup_$(date +%F)"
mkdir -p "$BACKUP_DIR"

echo "[*] Starting PHP Hardening Audit..."

for path in "${INI_PATHS[@]}"; do
  if [ -f "$path" ]; then
    echo "[*] Found config: $path"
    cp "$path" "$BACKUP_DIR/"
    
    # Check for dangerous functions
    if grep -q "disable_functions" "$path"; then
      echo "[!] disable_functions directive found in $path. Review manually."
    else
      echo "[+] Adding disable_functions to $path"
      echo "disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source" >> "$path"
    fi
    
    # Check for allow_url_include (common RCE vector)
    if grep -q "allow_url_include = On" "$path"; then
      echo "[!] CRITICAL: allow_url_include is ON in $path. Disabling..."
      sed -i 's/allow_url_include = On/allow_url_include = Off/g' "$path"
    fi
  fi
done

echo "[*] Audit complete. Backups stored in $BACKUP_DIR"
echo "[*] Please restart your web server (e.g., systemctl restart apache2 or php-fpm) to apply changes."

Remediation

The PHP project has explicitly stated no emergency fix is being issued for CVE-2026-115560. The primary remediation is configuration hardening.

1. Identify the Vulnerable Feature: The PHP advisory recommends "turning off a feature." Administrators must immediately review their php.ini and application configurations. Common features that lead to code execution include allow_url_include, register_globals (legacy), or specific unsafe modules. If the specific feature is identified in the full advisory, disable it immediately.
2. Apply the Principle of Least Privilege: Ensure the web server user (www-data, apache, nginx) has minimal permissions on the file system. It should not have write access to web root directories unless absolutely necessary for uploads, and certainly not to system binaries.
3. Disable Dangerous Functions: Use the disable_functions directive in php.ini to block exec, system, shell_exec, passthru, and other functions that allow OS command execution.
4. Monitor Vendor Advisories: Subscribe to the PHP Security Mailing List and monitor The Hacker News for updates. A patch may be released if exploitation is observed.
5. Web Application Firewall (WAF): Deploy or tune WAF rules to inspect incoming requests for patterns associated with PHP code injection (e.g., <?php, eval(, base64_decode).
6. Network Segmentation: Isolate web servers from internal database and management networks. A compromise should not grant an attacker access to the broader LAN.

Executive Takeaways

• Configuration is Key: This vulnerability is not a code bug but a configuration risk. Audit your php.ini and application settings today.
• Assume Exploitation: While currently theoretical, RCE flaws are rapidly weaponized. Implement the detection rules provided immediately.
• Defense in Depth: Do not rely on a single control. Combine configuration hardening, process monitoring, WAF, and network segmentation.
• Legacy Systems are High-Risk: If you maintain older PHP applications with custom configurations, prioritize them for review. They are the most likely to have the "unusual configuration" required for exploitation.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub