PHP: another vulnerability with no patch (CVE-2026-115560) and how a setting closes it
On October 23 the PHP team published an informational advisory about a bug in session upload progress that can lead to code execution on the server. The fix will come in the next regular release, there is no emergency patch. Exploitation needs an unusual configuration, and none had been reported as of October 23.
Who is affected
Only PHP sites and apps where all of this is true: session.serialize_handler is set to php_binary or php_serialize, the code switches it to php with ini_set() before session_start(), and session.upload_progress is enabled. An app that does not change the session handler at runtime is not in this scenario. The PHP team has not yet disclosed the affected versions.
How to check
Look in php.ini, the PHP-FPM pool and the site code for ini_set('session.serialize_handler', ...), and check session.upload_progress.enabled with php -i or in your hosting panel.
How to fix
Turn off session.upload_progress.enabled = 0 in php.ini, the PHP-FPM pool or the server configuration (not through ini_set) and restart PHP. The same setting is already recommended against PHP2Shell: if you applied it, nothing more is needed. Update PHP when the regular release with the fix arrives.
What Shield checks not checked
Session configuration cannot be seen from outside, so Shield does not check this threat, and we do not pretend it does. You can check it on your own server with the steps above.
Good to know
The PHP team has not yet disclosed details (root cause, affected versions, severity score), they are promised with the fix. We checked our own servers: the required session configuration is not used, and session.upload_progress is off.
