CVE-2026-115560Session upload-progress RCE with a runtime serializer switch
Requires upload progress plus php_binary/php_serialize configuration changed to php at runtime before session_start().
The emergency flush missed one unusual pipe
PHP warns of an unpatched session upload-progress RCE under unusual serializer settings
CVE-2026-115560 is an additional PHP RCE risk when upload progress is enabled and application code switches the session serializer from php_binary or php_serialize to php before session_start(). Disable upload progress pending the next regular fix.
- Disclosed
- Oct 23, 2026
- Public disclosure date
- Severity
- Sharted
- 1 CVE tracked here
- Splash zone
- Upload progress enabled + configured php_binary/php_serialize switched to php by ini_set() before session_start()
- php
- In the wild
- Unknown
- PHP's informational notice does not report exploitation
What happened
This is a separate advisory from the two PHP2Shell vulnerabilities patched on October 21. PHP calls the required configuration unlikely in practice, so the narrower exposure is rated L3.
This path requires session upload progress to be enabled, session.serialize_handler configured as php_binary or php_serialize, and application code switching it to php with ini_set() before session_start().
Applications that never change their session serializer at runtime can keep upload progress enabled. The full affected-version range, severity score and first patched release remain unpublished. Do not interpret an older PHP2Shell version check as clearance for this issue.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| PHP session upload progress | No fix | Fix planned for the next regular bugfix release; version range not yet published |
Can’t patch tonight? Plug the hole
session.upload_progress.enabled=0
Apply in server configuration and restart workers; retain this setting if already applied for PHP2Shell.
Crime-scene timeline
Oct 23, 2026
PHP publishes an informational notice and mitigation
A full advisory and fix are planned for the regular release cycle; exact versions and severity are not yet stated.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- PHP informational advisory, October 23PrimaryUnusual configuration required; disable session upload progress until the next regular fix