Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, the PHP security team disclosed CVE-2026-115560, a remote code execution vulnerability affecting PHP installations with non-default session serialization configurations. Exploitable only when session.serialize_handler is switched at runtime before session_start() with upload progress enabled, the flaw carries high severity despite its conditional nature. No patch was immediately available; mitigation required disabling session.upload_progress.enabled. This disclosure followed emergency patches for two related critical RCE flaws, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), which were already seeing broad exploitation attempts across millions of exposed PHP hosts globally before patches were released.

This incident underscores accelerating attacker timelines against unpatched web infrastructure. With over 5.1 million PHP hosts exposed online and exploitation of PHP2Shell beginning four days before patches shipped, organizations running PHP-based applications face shrinking windows between disclosure and active compromise, demanding proactive mitigation and network-layer controls beyond patch cycles alone.

Why This Matters Now

PHP powers nearly 70% of all websites, and active exploitation of the related PHP2Shell flaws began before patches were available, with multiple threat actors scanning and probing millions of exposed hosts. CVE-2026-115560 remains unpatched, making this an ongoing, live exposure window where network-layer controls and egress enforcement are critical interim defenses.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

CVE-2026-115560 is a remote code execution vulnerability in PHP affecting systems where session.serialize_handler is switched at runtime before session_start() with upload progress enabled. Organizations running PHP applications with this non-default configuration are at risk, and no vendor patch was immediately available at time of disclosure.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant here because the attack chain relied on flat network access from internet-exposed PHP servers into internal application infrastructure, cloud metadata services, and outbound attacker channels. By enforcing workload segmentation, identity-aware east-west policies, and controlled egress, CNSF would likely reduce the attacker's reachability across internal resources and limit the overall blast radius even when initial compromise of the PHP host occurred.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF perimeter visibility and ingress policy enforcement would likely reduce the exposed attack surface by limiting which PHP workload endpoints are reachable from untrusted internet sources, potentially constraining opportunistic scanning and exploit delivery to only explicitly permitted inbound paths rather than broadly open ports.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely constrain the attacker's ability to leverage harvested cloud IAM credentials or service account tokens for cross-workload or cross-account access, reducing the privilege scope available from the compromised PHP host to only what is explicitly permitted by identity-aware policy.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to freely pivot from the compromised PHP server to internal databases, caching layers, or adjacent microservices, constraining lateral reachability to only explicitly permitted workload-to-workload communication paths rather than allowing unrestricted internal traversal.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control would likely surface anomalous outbound connection patterns from PHP workloads toward known anonymization infrastructure or unexpected external destinations, enabling policy-driven constraints that could reduce the attacker's ability to maintain reliable C2 channels from within the cloud environment.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement would likely constrain the attacker's ability to transfer sensitive data to external destinations by limiting outbound connections from PHP workloads to only explicitly permitted egress paths, reducing the available exfiltration channels and potentially flagging unauthorized cloud storage API calls or unexpected large outbound data transfers.

Impact (Mitigations)

While the PHP host itself may remain compromised, the attacker's ability to propagate ransomware to connected databases, abuse harvested cloud credentials for cross-account impact, or exfiltrate large volumes of customer data would likely be reduced in scope due to constrained east-west paths, limited egress channels, and identity-scoped workload access.

Impact at a Glance

Affected Business Functions

  • Web Application Hosting and Delivery (PHP-powered websites and APIs)
  • E-commerce Platforms and Transaction Processing
  • Content Management Systems (CMS) including WordPress, Drupal, Joomla
  • Web Server Infrastructure and Backend Services
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

Given that PHP powers approximately 70% of all websites globally and over 5.1 million PHP hosts are exposed online, successful exploitation of PHP2Shell (CVE-2026-109618 and CVE-2026-109619) could result in arbitrary code execution on affected web servers. This could expose sensitive customer PII, authentication credentials, financial transaction records, session tokens, database contents, and proprietary application source code. The PHP2Shell vulnerabilities are unauthenticated RCE, meaning no prior access is required, significantly elevating the risk of mass exploitation across shared hosting environments, e-commerce platforms, and CMS deployments. As of the report date, no confirmed successful compromises have been publicly documented, but exploitation attempts are actively observed. Financial loss estimates are not confirmed; however, the scale of potential impact across millions of hosts could represent billions of dollars in aggregate exposure if exploitation succeeds at scale.

Recommended Actions

  • • Deploy Inline IPS (Suricata-based) with PHP RCE and PHP2Shell signatures (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) as an immediate compensating control to detect and block known exploit payloads targeting PHP session deserialization and upload progress abuse before patches are applied across all vulnerable hosts.
  • • Enforce Zero Trust Segmentation and East-West Traffic Security policies to isolate PHP application servers from internal databases, APIs, and cloud control plane services — preventing lateral movement from a compromised web tier to backend infrastructure and limiting blast radius if initial compromise occurs.
  • • Apply Egress Security and Policy Enforcement (FQDN filtering, outbound allow-listing) on all cloud-hosted PHP workloads to block unauthorized outbound connections to attacker C2 infrastructure, neutralizing webshell and reverse shell callback attempts that rely on unrestricted internet egress from application servers.
  • • Enable Multicloud Visibility and Control with anomaly detection across all PHP-hosting environments to surface reconnaissance patterns (scanning, fingerprinting, repeated malformed session requests) and post-exploitation behaviors (unusual outbound destinations, abnormal inter-service API calls) before attackers progress beyond initial compromise.
  • • Apply Cloud Firewall (ACF) internet egress controls with AI-based traffic discovery on PHP application VPCs and subnets to prevent data exfiltration via direct HTTP transfer or cloud storage API abuse, and ensure encrypted traffic (HPE/MACsec/IPsec) protects any sensitive data in transit that could be intercepted during or after compromise.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image