Related PHP flaw affects fully patched releases, with a Cloudflare protection caveat

The PHP patching story acquired another chapter on October 23. In an update to its php2shell report, Cloudflare says the PHP project published an informational advisory for CVE-2026-115560, a related vulnerability in session upload progress. It affects fully patched PHP releases, including 8.5.12, with a fix expected in the next regular release.

For operators relying on Cloudflare as an additional shield, the configuration detail matters: the company says its existing WAF rule covers known attempts only when PHP’s default upload progress field name is used. Customers who changed session.upload_progress.name are outside that rule’s coverage. Fully patched therefore does not mean this newly reported issue is resolved.

The original php2shell flaws, CVE-2026-109618 and CVE-2026-109619, can permit denial of service, code execution, and data exposure, according to Cloudflare’s account. Its guidance is to update the PHP runtime rather than just website code or plugins, while retaining WAF protection. The related upload-progress fix remains pending in the supplied update.