PHP warns of unpatched CVE-2026-115560: an unlikely RCE in session upload progress

What happened

On October 23, 2026, PHP posted an informational advisory titled "Session upload progress". It covers a new flaw, CVE-2026-115560.

PHP calls it an unlikely remote code execution vector. There is no patch yet. PHP will fix it in the next regular bugfix release and publish a full advisory then.

This comes two days after the PHP2Shell releases of October 21. Those fixed CVE-2026-109618 and CVE-2026-109619. They do not fix this new issue. Canada's Cyber Centre confirmed that in Update 1 to its PHP alert.

This is not a second PHP2Shell. PHP chose the regular release cycle because the setup is "unlikely in practice."

Who is affected

Only sites with an unusual mix of config and code are exposed. PHP says all three conditions must hold:

1. The configuration sets session.serialize_handler to php_binary or php_serialize.
2. The application then switches it to php at runtime with ini_set(). It does so before calling session_start().
3. Session upload progress is still enabled. That is the PHP default.

Apps that never change the serialize handler at runtime are not exposed. PHP says they can keep the feature on.

PHP has not published an affected version list yet.

What is confirmed

• The flaw is a possible RCE vector in session upload progress. PHP's own word is "unlikely."
• It is unpatched as of October 23.
• The October 21 releases (8.2.35, 8.3.36, 8.4.27 and 8.5.12) do not address it.
• The mitigation is session.upload_progress.enabled=0. PHP already listed it for CVE-2026-109619 on October 21.
• If you applied that setting on October 21 and kept it, PHP says no further action is needed.

What is not confirmed

• Severity. PHP has published no CVSS score. ThreatWire shows none and lists severity as unknown.
• Technical details. PHP is holding them for the full advisory.
• Exploitation. None has been reported for this CVE. The attacks seen since October 21 target the PHP2Shell pair.
• Public PoC. We found none.
• CVE records. CVE.org and NVD had no published record when we checked.
• CISA KEV. Not listed.

What to do

1. Patch PHP2Shell first. If you have not, update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now. Those flaws are critical and exploited.
2. Disable session upload progress. Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server config. Do not rely on ini_set() or .user.ini. Restart every PHP worker.
3. Keep it off until PHP ships the next bugfix release.
4. Check your code if you must keep the feature. Look for apps that change session.serialize_handler at runtime. If none do, PHP says you are not exposed.
5. Watch for the full advisory and the next PHP release, then update.

Related coverage

PHP2Shell: the full explainer and checklist, and the exploit attempt Amazon logged four days before disclosure.

Records: CVE-2026-115560, CVE-2026-109618 and CVE-2026-109619. Browse the CVE tracker.

Sources: PHP's informational advisory, php-src advisory GHSA-6wmf-4rv5-p3rp, the Canadian Centre for Cyber Security and BleepingComputer. Links are in the references list.