Peplink Security Advisory: PHP Remote Code Execution Vulnerability (CVE-2026-115560)

Ref.: #38338

Published: 2026-10-29 [Last updated: 2026-10-29]

Status

Mitigation is available for the affected products, while pending for PHP update with the permanent fix.

Background

After the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were announced last week, a new vulnerability (CVE-2026-115560) was found a few days ago this week, in which a web component that uses PHP session configuration could potentially be exploited for remote code execution. And reported in this post.

Details of the vulnerability can be found at the external reference link below:

CVE-2026-115560

The fix for the PHP2Shell released on 2026-10-22 (firmware 8.6.1s042) does not remediate this new vulnerability. It needs to update the PHP component configuration parameter to mitigate the exposure (set session.upload_progress.enabled=0, to a disabled state).

The Balance and MAX routers with Edge Computing (EC) feature enabled and running will be affected, as the EC feature utilizes a PHP component. The EC feature is disabled by default.

Other models and appliances (FusionHub and ICVA) are not affected.

Products affected:

Peplink Balance and MAX series with EC feature enabled, with firmware version up to 8.6.1s042, are vulnerable.

Mitigation

On Peplink Balance and MAX series with the EC feature, upgrade to the special firmware (8.6.1s054, based on 8.6.1s042) that changes the specific configuration parameter (session.upload_progress.enabled) to “disabled” at the system level. This change will be included in the next GA release.

Here are the direct download links for special firmware 8.6.1s054 (based on 8.6.1s042):

Solution

Pending PHP update with the permanent fix.

We will update this post if anything changes.

Reference link:

Peplink Security Advisory: PHP Remote Code Execution Vulnerability (CVE-2026-115560) - Announcements / Peplink Security Advisories - Peplink Community