PHP Issues Follow-Up Advisory on Unlikely Session Upload Progress RCE Vector (CVE-2026-115560)

On October 23, 2026, the PHP project published an informational advisory recommending that administrators set session.upload_progress.enabled=0 until the next regular bugfix release. This fully protects against an unlikely remote code execution (RCE) vector now tracked as CVE-2026-115560. The recommendation builds directly on mitigation guidance issued two days earlier and applies to all PHP installations serving web requests.

Background: Critical PHP2Shell Patches (October 21, 2026)

On October 21, PHP released emergency security updates (PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12) fixing two critical unauthenticated RCE vulnerabilities, both rated CVSS v4.0 9.2:

• CVE-2026-109618 (RCE via OOM corruption; GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619 (RCE via stale global state; GHSA-6wmf-4rv5-p3rp)

These affect PHP worker processes (highest risk on mod_php) because request-owned state can persist after memory is freed or because out-of-memory handling can leave internal structures in an inconsistent state. Session upload progress was already identified as one confirmed consumer path for the stale-state issue, which is why disabling it was listed as a partial mitigation. Organizations that applied that setting on October 21 need take no further action for the new advisory.

CVE-2026-115560 is a separate issue and is not fixed by the October 21 releases. For the original technical breakdown of those two flaws and their exploitation status, see our PHP2Shell advisory update.

Details of CVE-2026-115560

The vulnerability can only be triggered under a specific and uncommon combination of configuration and application behavior:

• session.serialize_handler is set to php_binary or php_serialize in the server configuration.
• The application later switches the handler to php at runtime with ini_set() before calling session_start().
• Session upload progress remains enabled (it is on by default).

Applications that never change the serialize handler at runtime are not exposed through this vector and may safely leave the feature enabled. Because this configuration is rare in practice, the PHP project is treating the issue in the regular release cycle rather than issuing another emergency patch. A full advisory will be published alongside the next bugfix release.

Recommended Actions

Set session.upload_progress.enabled=0 in php.ini, an FPM pool configuration, or equivalent server-level settings that take effect before request parsing, then restart all PHP workers. This is the same low-cost control already advised for CVE-2026-109619.

• If the setting was already disabled for the earlier advisory, leave it disabled.
• Verify the running configuration (for example, via php-fpm -i | grep upload_progress or the correct SAPI's phpinfo()).
• Continue prioritizing updates to the patched releases (8.2.35+, 8.3.36+, 8.4.27+, 8.5.12+). PHP 8.2 reaches end of security support on December 31, 2026; older branches (8.1 and below) no longer receive official updates from the PHP project.

Session upload progress writes client-supplied filenames and field names into the session store before script execution. PHP's own documentation has long recommended disabling the feature when upload progress bars are not required, as unsanitized values can make local file inclusion issues easier to exploit.

Summary

The real-world risk of CVE-2026-115560 appears low due to the narrow preconditions required. Nevertheless, the recommended configuration change provides inexpensive defense-in-depth on top of the critical October 21 patches. Organizations should confirm their session settings, apply the mitigation if it is not already in place, and watch for the forthcoming full advisory and fix in the next regular PHP release.

Primary source: PHP News Archive – 2026-10-23-1