PHP advises disabling session upload progress to mitigate new RCE risk

The PHP project has issued an informational advisory warning of a new remote code execution (RCE) vulnerability, identified as CVE-2026-115560. This warning arrives just two days after the release of emergency patches for the critical PHP2Shell flaws. The project recommends that administrators disable the session upload progress feature immediately as a mitigation strategy.

What happened

On October 23, the PHP development team published a short advisory detailing the new security issue. Unlike the previous critical vulnerabilities, this flaw does not affect all PHP installations. It targets a narrow and uncommon configuration where an application dynamically changes its session serialization handler during runtime. Specifically, the risk exists when an application sets the session.serialize_handler option to php_binary or php_serialize in its configuration, then switches it to php using ini_set() before calling session_start(), while session upload progress remains enabled.

The PHP team has classified this as an unlikely risk in practice because most applications do not change serialization handlers on the fly. Consequently, they are not issuing an emergency patch. Instead, the fix will be included in the next routine bugfix release. The advisory explicitly states that setting session.upload_progress.enabled=0 neutralizes the threat. This is the same mitigation recommended for the previous PHP2Shell vulnerability, meaning administrators who already applied that change are protected from this new issue as well.

This new vulnerability is distinct from the two critical flaws patched on October 21, known as CVE-2026-109618 and CVE-2026-109619. Those earlier flaws allowed unauthenticated attackers to execute code on servers and were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The current issue, CVE-2026-115560, is not resolved by those updates. No exploits targeting this new vulnerability have been reported so far.

Key details

• Vulnerability ID: CVE-2026-115560 affects PHP installations with specific dynamic session serialization configurations.
• Mitigation: Set session.upload_progress.enabled=0 in your PHP configuration until a routine fix is released.
• Scope: The risk is limited to applications that change session.serialize_handler via ini_set() before session_start().
• Status: No emergency patch is being issued; the fix will arrive in the next regular maintenance release.
• Previous Patches: The October 21 emergency releases for CVE-2026-109618 and CVE-2026-109619 do not fix this new issue.
• Exploitation: There are no reported attempts to exploit CVE-2026-115560, though attacks on the previous PHP2Shell flaws continue to surge.

Background

Session upload progress is a built-in PHP feature that allows web applications to track the status of file uploads in real time. It is enabled by default in many standard configurations. While useful for user experience, it introduces complexity in how session data is handled. Serialization is the process of converting data structures into a format that can be stored or transmitted. PHP supports different serialization handlers, such as php, php_binary, and php_serialize. Switching between these handlers dynamically during a request can lead to inconsistencies in how session data is interpreted, potentially creating security gaps if not managed carefully.

The recent PHP2Shell vulnerabilities highlighted the dangers of improper input handling in PHP’s core functions. Those flaws allowed attackers to inject malicious code through seemingly benign requests. The security community responded rapidly, with cloud providers like Cloudflare reporting millions of exploitation attempts within hours of the disclosure. Attackers attempted to install Mirai botnet variants, though reliable exploitation proved difficult. Understanding the distinction between these actively exploited flaws and the newly disclosed, lower-risk configuration issue is vital for prioritizing response efforts.

Why it matters

For teams managing self-hosted software, this advisory reinforces the importance of configuration hygiene over simple version updates. While patching to the latest PHP version is critical for the previous RCE flaws, it does not solve this new problem. Administrators must actively review their php.ini settings or application-level configurations. If you rely on session upload progress for legitimate functionality, you need to assess whether your application dynamically changes serialization handlers. If it does not, you may still choose to disable the feature as a defense-in-depth measure, given the low likelihood of needing it in modern architectures.

The rapid surge in attacks against the previous PHP2Shell flaws demonstrates how quickly automated bots scan for newly disclosed vulnerabilities. Even though CVE-2026-115560 is currently considered low risk, the pattern of immediate exploitation attempts suggests that any publicly disclosed weakness will be probed. By applying the recommended configuration change now, you eliminate a potential attack vector before a formal patch is available. This proactive approach reduces the window of exposure and simplifies future maintenance, as you will not need to rush an emergency update when the routine fix is eventually released.

What you can do

• Disable session upload progress: Add session.upload_progress.enabled=0 to your php.ini file or application configuration immediately.
• Verify existing mitigations: If you already disabled session upload progress to mitigate CVE-2026-109619, no further action is required for this specific issue.
• Check serialization logic: Review your application code to see if it uses ini_set() to change session.serialize_handler before session_start().
• Monitor for updates: Watch for the next routine PHP bugfix release, which will contain the permanent fix for CVE-2026-115560.
• Audit logs: Continue monitoring server logs for unusual activity related to session handling or file uploads, even though no exploits are currently reported.
• Update PHP versions: Ensure you are running PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to remain protected against the critical PHP2Shell flaws.