PHP: Third alert on session upload progress, CVE-2026-115560 unpatched

The PHP project published a third security advisory on 23 October 2026 concerning session handling, separate from the two critical vulnerabilities patched on 21 October with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It affects those running PHP in production who must decide whether to maintain the configuration adopted in recent days.

What the advisory says

The statement published by php.net is direct: "We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector". Those who already applied this setting on 21 October as mitigation for CVE-2026-109619 need take no further action.

The flaw, identified as CVE-2026-115560, requires three conditions to occur together: an application must set session.serialize_handler to php_binary or php_serialize in configuration, then change it at runtime in PHP using ini_set() before calling session_start(), with session upload progress still active. Session upload progress must additionally remain active, and the PHP manual lists it as active by default; applications that never change the serialisation handler at runtime can keep the feature enabled. For this reason, PHP is treating the issue in the regular release cycle, with no announced patch date.

Why it differs from 21 October

Cloudflare reports that CVE-2026-115560 also affects already-updated PHP versions, including 8.5.12, and will be resolved in the next regular release. Unlike the two RCEs from 21 October, which had CVSS 9.2 published immediately, this flaw was reported by BleepingComputer and The Hacker News on 23 October, yet checking NVD, CVE.org and OSV APIs showed no record had yet been created.

The behaviour is not unprecedented: according to the timeline reconstructed by those examining PHP's historical bugs, 12 December 2015 marked Bug #71101 being reported as a security issue, describing how upload progress allows a client to influence a key in $_SESSION and how changing the handler mid-script causes PHP to interpret session data in the wrong format—later reclassified in 2021 as a documentation-only issue.

What to do

Those who have not yet applied the 21 October mitigation must set session.upload_progress.enabled=0 in the actual configuration, not with ini_set(), and restart PHP-FPM workers. Applications that never modify session.serialize_handler at runtime can leave the feature active.