Another PHP flaw awaits a patch, but one setting fully protects you
On October 23, the PHP team disclosed CVE-2026-115560, exploitable only in a rare configuration. Here is the setting to apply and how to tell whether your application is affected.
Translated from French by AI. The original French article is the reference version.
Just two days after the emergency PHP2Shell fixes, the PHP security team published a new advisory on Friday, October 23. It covers another vulnerability, tracked as CVE-2026-115560, that could allow remote code execution on a server. This time, no patched version is available. The fix will arrive with the next maintenance release, with no date announced.
The good news comes down to one line of configuration. PHP recommends disabling the upload progress tracking feature (session.upload_progress.enabled=0) until the next release. According to the advisory, this setting fully protects against what it describes as an “unlikely” code execution vector.
A flaw that requires an unusual setup
To be exposed, an application must meet several conditions at once. Its configuration must set the session storage format to php_binary or php_serialize. The code must then switch back to the php format at runtime, using ini_set(), before calling session_start(). Finally, upload progress tracking must be enabled, which it is by default.
The PHP team considers this setup “unlikely in practice.” That is why it is handling the flaw in the normal release cycle rather than as an emergency. Applications that never change session format at runtime can, in its view, leave the feature enabled. The BleepingComputer article relaying the advisory reports no exploitation of this flaw.
Those who followed the October 21 guidance have nothing to do
This setting is not new. It was already among the workarounds in the advisory published on October 21 for CVE-2026-109619, one of the two PHP2Shell flaws whose details leaked before they were fixed. PHP says so clearly: if you applied it then, keep it, and no further action is needed.
For PHP2Shell, the patched versions were released on October 21: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These updates remain the priority, since exploitation attempts have been observed. They even led the French government to take down prefecture websites.
What should you do?
The procedure is short, yet many PHP servers are probably still running the default setting.
- First, install the October 21 versions if you have not done so yet.
- Disable upload progress tracking by adding
session.upload_progress.enabled = 0to thephp.inifile, the PHP-FPM pool configuration or the web server configuration. The setting must be read before the request is processed: the October 21 advisory states thatini_set()and.user.inifiles are not suitable. - Check your applications' code. Look for a call to
ini_set('session.serialize_handler', ...)placed beforesession_start(). If there is none, you are not in the case described. - Test your file upload forms after the change: a progress bar that relies on this feature may no longer display.
PHP will publish a full advisory on CVE-2026-115560 with the next release. You will then need to check the affected versions and apply the patch. The installed base to protect is huge: VirusTotal, cited by BleepingComputer, counts more than 5.1 million PHP servers reachable from the Internet.
Method: AI-assisted monitoring, verified sources, article reviewed and approved by Frédéric LENQUETTE. Our editorial policy.
Share this article
