PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation
Do Son 
TL;DR
On October 23, 2026, the PHP team disclosed CVE-2026-115560, a new PHP session vulnerability tied to session upload progress. It can lead to remote code execution, but only in a rare setup. PHP advises setting session.upload_progress.enabled=0 until the next bugfix release.
- Product: PHP Group PHP
- Vulnerabilities: 1 flaw (CVE-2026-109619)
- Highest severity: 9.2 (Critical · CVSSv4)
- Worst impact: RCE via stale global state
- Status: No confirmed exploitation yet; patches available
- Action: Update to 8.2.35, 8.3.36, 8.4.27, 8.5.12 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-109619 | 9.2 | RCE via stale global state | 8.2.35, 8.3.36, 8.4.27 (+1) | Not exploited |
Why It Matters
The warning lands just days after the PHP2Shell emergency release. Attackers are already exploiting PHP2Shell broadly, according to Amazon Threat Intelligence. So admins are watching every new PHP bug closely.
The good news is that this flaw is far narrower. PHP calls it “an unlikely RCE vector” and is fixing it in the normal release cycle. Even so, this PHP session vulnerability touches the same feature used in a PHP2Shell attack path.
How the Attack Works
The bug needs three things at once. According to the PHP news notice on CVE-2026-115560:
- An app sets session.serialize_handler to php_binary or php_serialize in its configuration.
- It then switches the handler to php at runtime with ini_set() “before calling session_start().”
- Session upload progress is still enabled.
PHP stresses that “the issue can only occur under an unusual combination of configuration and application code.” Apps that never change the serialize handler at runtime “can keep the feature enabled.”
Exploitation status
No source reports exploitation of this PHP session vulnerability, and no public proof-of-concept is known. PHP will publish a full advisory with the next release.
Affected Versions
PHP has not yet listed affected versions. Details will come with the full advisory.
Patch and Mitigation Steps
- Set session.upload_progress.enabled=0 until the next bugfix release.
- Check whether your code changes the serialize handler at runtime.
- Keep the PHP2Shell updates in place.
Notably, this same setting already appeared as a mitigation in PHP’s October 21 advisory for CVE-2026-109619. “If you applied it then, keep it in place and no further action is needed,” the PHP team says.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
