CVE-2026-115560

CVE-2026-115560 is a remote code execution vector in PHP's session upload progress feature. PHP announced it on 23 October 2026 in an informational advisory. It is not patched yet.

PHP calls it an unlikely RCE vector. It only appears with an unusual mix of configuration and application code. All of these must be true:

• The configuration sets session.serialize_handler to php_binary or php_serialize.
• The application then switches the handler to php at runtime with ini_set(), before it calls session_start().
• Session upload progress is still enabled. It is on by default.

Apps that never change the serialize handler at runtime are not exposed, per PHP. They can keep the feature enabled.

The 21 October PHP2Shell releases do not fix this issue. Canada's Cyber Centre confirmed that in an update to its PHP alert. PHP will ship the fix in its next regular bugfix release. A full advisory will come with it.

PHP has not published a CVSS score, a CWE or an affected version list yet. ThreatWire leaves those fields empty. The CVE record was not yet live on CVE.org or NVD when we checked.

Mitigation: set session.upload_progress.enabled=0. Set it in php.ini, the FPM pool or server config, then restart PHP workers. This is the same setting PHP listed for CVE-2026-109619 on 21 October. If you applied it then and kept it, PHP says no further action is needed.

Exploitation: none reported for this CVE. The attacks seen since 21 October target the PHP2Shell pair, CVE-2026-109618 and CVE-2026-109619. ThreatWire found no public PoC. It is not in CISA KEV.

Read the full story. For PHP2Shell, see the explainer.