PHP advises disabling session upload progress over CVE-2026-115560

PHP advises disabling session upload progress over CVE-2026-115560

23 October 2026: The PHP project has published an informational advisory asking users to set session.upload_progress.enabled=0 until its next regular bugfix release, to close what it calls an unlikely remote code execution vector tracked as CVE-2026-115560. It follows the critical fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 two days earlier, and the setting was already listed as a mitigation in that week's advisory for CVE-2026-109619.

Not yet independently verified. PHP will publish the full advisory for CVE-2026-115560 with its next regular release; until then there is no CVSS score, no public CVE record and no fixed version. We will update this when it can be confirmed, and remove this note.

The configuration that is exposed

PHP describes the issue as needing an unusual combination of configuration and application code. All three conditions must hold:

• the configuration sets session.serialize_handler to php_binary or php_serialize;
• the application then switches the handler to php at runtime with ini_set() before calling session_start();
• session upload progress is still enabled, which is PHP's default.

Applications that never change the serialize handler at runtime can keep upload progress enabled. Because the setup is unlikely in practice, PHP is handling it in its normal release cycle rather than with another emergency release, and says the full advisory will come with that release.

What to do this week

Teams that applied the CVE-2026-109619 mitigations on 21 October, including turning off session upload progress, need do nothing more: PHP says to keep the setting in place. Everyone else has two choices. The simple one is to set session.upload_progress.enabled=0 in php.ini, the FPM pool configuration or the server's PHP settings, and restart PHP workers so the change takes effect. The feature only reports the progress of file uploads into the session, so turning it off removes a progress bar at most. The other is to search the code base for ini_set calls that change session.serialize_handler and confirm none of them switches it to php. Shared hosts and platforms running customers' code cannot know what that code does, so the configuration change is the safer default there.

The 21 October fix still comes first

The earlier advisory remains the urgent one. GHSA-6wmf-4rv5-p3rp says that updating to the complete state-reset patch is the only reliable mitigation for CVE-2026-109619, with fatal_error_backtraces=0 and worker restarts as a stopgap on PHP 8.5, and pm.max_requests=1 as extra hardening.

Sources

• PHP.net: Informational advisory: Session upload progress (home page news, read 2026-10-23), 23 October 2026
• GitHub Security Advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), 21 October 2026