PHP CVE-2026-115560: turn off session upload progress now

Two days after the PHP2Shell emergency patches, PHP published a second advisory. CVE-2026-115560 is a remote code execution path through session upload progress, and the October 21 releases do not fix it. PHP calls it unlikely in practice and will fix it in the next regular release, not an emergency one. The fix you can apply today is one line in php.ini. If you patched PHP this week and called it done, read this first.

What actually happened

On October 23, the PHP project posted an informational advisory. It tells users to set session.upload_progress.enabled=0 until the next bugfix release. The RCE needs an unusual setup, and every one of these must be true:

• The config sets session.serialize_handler to php_binary or php_serialize.
• The application code switches it to php at runtime with ini_set() before it calls session_start().
• Session upload progress is still enabled, which is the default.

PHP says applications that never change the serialize handler at runtime can keep the feature on. The project has not said which versions are affected and has not given a severity score. A full advisory comes with the next release. The Hacker News reports no known exploitation of this CVE so far. That is not true of the earlier bugs: it cites Cloudflare seeing PHP2Shell attempts climb into the millions by October 22.

This is the same setting PHP already listed as a partial mitigation for CVE-2026-109619 in its October 21 advisory. If you applied it then, keep it.

Why the session upload progress fix matters for your business

You probably cannot answer the ini_set() question. "Does any code on this server change the serialize handler at runtime?" sounds simple. On a WordPress site with 30 plugins, or a Laravel app with years of vendor code, nobody knows without a grep. Turning the feature off is cheaper than auditing.

Almost nobody uses it. Upload progress powers old-style progress bars for file uploads. Most modern upload UIs track progress in JavaScript. Test your upload forms after the change, but expect nothing to break.

Set it where it counts. PHP's October 21 guidance is clear: put it in php.ini, the FPM pool, or server config, then restart every worker. A .user.ini file or an ini_set() call is too late, because the attack runs before your code does.

Sources: PHP advisory, October 23, 2026, The Hacker News. Background: our PHP2Shell post.