CVE-2026-115560: PHP reports another RCE in session upload progress, distinct from PHP2Shell

The PHP project published an advisory on 23 October 2026 at 10:12 UTC on php.net requesting that session.upload_progress.enabled=0 be set until the next regular bugfix release, to protect against an RCE vector deemed unlikely and tracked as CVE-2026-115560. This is a distinct flaw from the two critical RCE vulnerabilities in PHP2Shell (CVE-2026-109618 and CVE-2026-109619) patched on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35: updating to those versions does not close this issue.

Who needs to take action

Those who had already disabled session upload progress as a mitigation for CVE-2026-109619 need do nothing: the setting was already recommended in the GHSA-6wmf-4rv5-p3rp advisory published on 21 October 2026 and remains valid.

For others, the risk condition is specific. An application must set session.serialize_handler to php_binary or php_serialize in configuration, then change it to php at runtime with ini_set() before calling session_start(), whilst session upload progress is still enabled. Applications that never change the serialize handler at runtime can leave the feature active without being exposed.

The 2015 precedent

The issue is not entirely new: it was previously reported as a security bug on 12 December 2015 (#71101), with the same mechanism described — upload progress allowing clients to influence a key in $_SESSION and a handler change mid-script causing PHP to read session data in the wrong format. The bug was then reclassified from a security issue to an ordinary bug on 1 January 2016.

What to do now

• Set session.upload_progress.enabled=0 in php.ini, in FPM pool configuration or at server level, before the request is processed.
• Restart all PHP workers after making the change.
• Do not consider the PHP2Shell patches from 21 October as resolving this case.

PHP has not yet published the affected versions, those which will contain the definitive fix, nor a severity score: the full advisory for CVE-2026-115560 will arrive with the next regular release.