PHP CVE-2026-115560: Turn Off Session Upload Progress Until the Next Release

If your website runs on PHP, there is one more setting to check this week. On 23 October 2026, two days after the emergency PHP2Shell fixes, the PHP project published a short informational advisory about another remote code execution risk, tracked as CVE-2026-115560. PHP itself calls it unlikely, and it is not issuing an emergency release.

The action it asks for takes one line: set session.upload_progress.enabled=0 until the next regular bugfix release.

What PHP said

According to the advisory, the issue can only occur under an unusual combination of configuration and application code. An application needs to do all three of these:

1. Set session.serialize_handler to php_binary or php_serialize in its configuration.
2. Switch it to php while running, by calling ini_set() before session_start().
3. Still have session upload progress enabled.

Applications that never change the serialize handler while running can keep the feature enabled. Because the setup is unlikely in practice, PHP will publish a full advisory for CVE-2026-115560 with the next release. As of 23 October, the advisory does not list affected versions or a severity score, and reporting by The Hacker News says no exploitation had been reported.

How this relates to PHP2Shell

The same setting was already listed as a mitigation in PHP's 21 October advisory for CVE-2026-109619, one of the two PHP2Shell flaws. PHP says that if you applied it then, you should keep it in place and no further action is needed.

This is a separate issue. The 21 October releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) fixed the two PHP2Shell flaws, and they are not described as fixing this one. Read our PHP2Shell patch guide first if you have not updated yet.

What to do today

1. Update PHP to a fixed version if you have not already. The mitigation here is not a substitute for patching.
2. Set session.upload_progress.enabled=0 in your PHP configuration, then restart or reload PHP so the change takes effect.
3. Check the value that PHP really uses. A phpinfo() page or php -i shows the loaded value. Remember that the command line, PHP-FPM pools and per-site .user.ini files can each have their own settings.
4. Search your code for runtime changes. Look for ini_set('session.serialize_handler' or session_start code that changes the handler. If nothing does, you are outside the case PHP describes, but turning the feature off is still a cheap safeguard.
5. Ask your hosting provider whether they manage this setting for you, and whether they have applied the PHP2Shell updates.
6. Test file uploads on your site after the change, especially if you have a progress bar.
7. Watch for the next PHP bugfix release and plan to update again when the full advisory is published.

For a routine that keeps this from piling up, see our website maintenance guide. If you want a hand checking your PHP settings and versions, talk to Susraj Tech.

Frequently asked questions

Is there a patch for CVE-2026-115560?

Not yet. PHP is fixing it in the regular release cycle.

Will turning off session upload progress break my site?

Only features that track upload progress through the session, which most sites do not use.

Sources

• PHP.net: Informational advisory, Session upload progress (23 October 2026)
• The Hacker News: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

Last reviewed 23 October 2026. This article is general security information, not a guarantee of protection. Details may change when PHP publishes the full advisory.