Full-Stack Developer & AI-Assisted Product Builder| System Administrator
Cybersecurity

PHP Discloses New RCE Risk in Unusual Session Configurations

By Parviz Nasirov
PHP Discloses New RCE Risk in Unusual Session Configurations

PHP has disclosed CVE-2026-115560, an unpatched remote code execution risk affecting an uncommon session configuration, and provided a temporary mitigation.

PHP Issues New Security Warning

PHP has disclosed CVE-2026-115560, a potential remote code execution vulnerability involving session upload progress. Its October 23 advisory describes the required configuration as unusual, with a fix planned for the regular release cycle.

Which Applications Are Exposed?

The issue requires session upload progress to remain enabled while an application starts with session.serialize_handler set to php_binary or php_serialize, then changes it to php through ini_set() before calling session_start().

Temporary Mitigation

PHP recommends disabling session upload progress until the next regular bugfix release:

session.upload_progress.enabled=0

Administrators who already applied this mitigation should retain it. Applications that never change their serialization handler at runtime are not exposed through this specific path.

Earlier Security Updates Remain Essential

The warning follows the October 21 patches for CVE-2026-109618 and CVE-2026-109619. Those fixes were released in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should install the appropriate security update and review session settings while awaiting the new fix.

Official PHP advisory: https://www.php.net/archive/2026.php#2026-10-23-1

Analysis and context

The practical priority is to distinguish patch status from configuration exposure. Installing the October 21 security updates addresses the two earlier vulnerabilities, while the new advisory calls for a separate review of session configuration and runtime handler changes. Disabling upload progress may affect applications that use PHP’s built-in upload progress tracking, so verify that workflow after applying the mitigation.