PHP has published an informational advisory for CVE-2026-115560, a new and unlikely remote code execution vector in session handling, and asks administrators to turn off session upload progress until the next bugfix release.
The entry on php.net is dated Oct. 23, two days after the emergency releases for the two critical PHP2Shell flaws that we covered when PHP gave advance notice of the fixes. This is a separate CVE. PHP suggests setting session.upload_progress.enabled=0 until the next regular bugfix release. The same setting was already listed as a mitigation in the advisory for CVE-2026-109619, so anyone who applied it on Oct. 21 needs no further action.
PHP says the issue needs an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration, then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature on. Because the setup is unlikely in practice, PHP is handling the fix in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.
The entry gives no CVSS score, affected version range or fix version, and it does not say the flaw is being exploited. Those gaps matter because the earlier flaws drew heavy scanning, which Amazon’s telemetry traced to four days before disclosure.
In our reading, the practical check is short. Search your php.ini files, pool configuration and application code for session.upload_progress.enabled and for any runtime ini_set() call on session.serialize_handler. A fleet that already carries the Oct. 21 mitigation is covered. A fleet that patched without applying it still has the setting on.
Source: PHP.net, Informational advisory: Session upload progress, Oct. 23, 2026
