PHP CVE-2026-115560 Session Upload Progress Explained: New RCE Flaw Two Days After PHP2Shell Patches

Image: Wikimedia Commons — PHP project logo (CC BY 4.0)

TL;DR — The Answer: PHP CVE-2026-115560 session upload progress explained: on 23 October 2026, the PHP project published an informational advisory warning of a new remote-code-execution vector tied to the session upload progress feature. It only works under a rare configuration combination, so PHP calls it "unlikely" and is fixing it in the regular release cycle — the interim fix is one config line: session.upload_progress.enabled=0.

📌 KEY HIGHLIGHTS

• New advisory, 23 October 2026: PHP's security team published an informational advisory on php.net for a remote-code-execution vector now tracked as CVE-2026-115560 — two days after the critical PHP2Shell emergency patches.
• Narrow attack path: it can only occur when an app sets session.serialize_handler to php_binary or php_serialize, switches it to php at runtime with ini_set() before session_start(), and leaves session upload progress enabled.
• Not fixed by the 21 October patches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 closed the PHP2Shell flaws — this one is separate, with a full advisory and fix coming in the next regular bugfix release.
• One-line mitigation: set session.upload_progress.enabled=0 until the next release. If you already disabled it on 21 October while responding to CVE-2026-109619, PHP says keep it in place — no further action needed.
• Honest risk level: PHP itself describes exploitation as "unlikely in practice" — no severity score assigned yet, no confirmed exploitation, no emergency release.

What happened?

Two days after the PHP2Shell emergency forced the world's web hosts to scramble — emergency fixes on 21 October, millions of exploitation attempts logged by Cloudflare, government sites in the Netherlands and Japan taken offline as a precaution — the PHP project posted a short new notice on php.net: an informational advisory on session upload progress, published 23 October 2026.

The notice tracks a new remote-code-execution vector, CVE-2026-115560, and its tone is deliberately different from the alarm of Wednesday. PHP calls the vector "unlikely", says no emergency release is needed, and will publish the full advisory with the next regular bugfix release. The key question: is this the same as PHP2Shell? No — as covered in our PHP2Shell patch guide for website owners, the 21 October updates fix only CVE-2026-109618 and CVE-2026-109619; this is a separate issue needing a separate response.

PHP CVE-2026-115560 session upload progress: the three conditions

The advisory is unusually specific about how narrow the exposure is. Per php.net, all three of these must be true at the same time — miss any one and this attack path does not exist:

Condition	What it means
1. session.serialize_handler is php_binary or php_serialize	The server configuration uses a non-default session serializer.
2. The app switches it back to php with ini_set() before session_start()	Application code changes the handler at runtime — the part PHP says is "unlikely in practice".
3. Session upload progress stays enabled	The upload-tracking feature (on by default in PHP) is left on.

PHP's own words: "Applications that never change the serialize handler at runtime can keep the feature enabled." The session upload progress feature exists to let applications track file-upload progress — disabling it is harmless for most sites, but it is only required for apps matching the pattern above.

Image: Wikimedia Commons / Markus Spiske — CC0 public domain (illustrative image)

What to do: the one-line fix

The mitigation is the same setting already on the list from the 21 October advisory for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), so many administrators applied it days ago:

• If you disabled session upload progress on 21 October: keep it disabled. PHP says explicitly — "no further action is needed".
• If you didn't: set session.upload_progress.enabled=0 in php.ini, an FPM pool, or the server configuration — not via ini_set() or a .user.ini file, because those apply too late — then restart every PHP worker.
• This does not replace the PHP2Shell patches. The October 21 updates are still mandatory: only PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 close the two critical flaws. The config line and the version upgrade cover different problems.

The PHP Foundation confirmed the same guidance on its official X account on 23 October, and the full advisory will follow with the next regular bugfix release — on the normal release cadence, not another emergency drop.

Why it matters for World Tech readers

October 2026 has been brutal for internet infrastructure: PHP2Shell broadly exploited within days, a Cloudflare network incident, Google's London cloud outage, and the LiteLLM supply-chain attack cleanup guide documenting a credential stealer smuggled onto PyPI. Against that backdrop, even an "unlikely" vector deserves attention — the one-line fix costs nothing, while ignoring a PHP RCE advisory this month has proven risky.

For India's enormous WordPress and shared-hosting ecosystem — millions of small-business sites whose owners can't patch PHP themselves — the practical read is simple: ask your host whether session.upload_progress.enabled=0 is in place alongside the patched PHP build. Five minutes closes two of the week's attack paths at once. And the pattern holds: CISA's catalog kept filling all week — including CISA's KEV-listed Plex2Shell flaws — so treating every core-runtime advisory as a same-day task is now the sane default.

Should you care?

✅ Yes — calmly, and mostly for admins: if you run a PHP server, set session.upload_progress.enabled=0 (or confirm your host did). One line, no downtime, no code change.

⏳ Wait if you only visit websites: no action needed on your side. Watch the next regular PHP bugfix release — that will carry the real fix.

FAQs

What is CVE-2026-115560?
It is a remote-code-execution vector in PHP's session upload progress feature, disclosed via an informational advisory on php.net on 23 October 2026. It can only occur under an unusual combination of session configuration and application code — PHP describes exploitation as "unlikely in practice" and is fixing it in the regular release cycle, not with an emergency patch.

Is CVE-2026-115560 fixed by the PHP2Shell patches?
No. The 21 October emergency updates (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) fix only CVE-2026-109618 and CVE-2026-109619 — the PHP2Shell flaws. CVE-2026-115560 is a separate issue; it is not addressed by those updates, and its fix will arrive in the next regular bugfix release.

How do I disable session upload progress in PHP?
Set session.upload_progress.enabled=0 in php.ini, an FPM pool, or the server configuration — not via ini_set() or .user.ini, which apply too late — then restart every PHP worker. If you applied this setting on 21 October for CVE-2026-109619, keep it in place and do nothing more.

Am I affected by the new PHP session upload progress flaw?
Only if your application sets session.serialize_handler to php_binary or php_serialize in its configuration, switches it to php at runtime with ini_set() before session_start(), and leaves session upload progress enabled. Applications that never change the serialize handler at runtime are not exposed through this path, per PHP.

Takeaway: Two days after PHP2Shell, PHP flagged one more RCE path — but this time the fix is a single config line, not another emergency upgrade. Set session.upload_progress.enabled=0, keep it through the next bugfix release, and confirm the 21 October patches are in place for the real emergency.

Follow World Tech on TechByCountry for the next hourly update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• php.net — Informational advisory: Session upload progress (primary, 23 Oct 2026)
• The Hacker News — PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches (23 Oct 2026)
• Security Affairs — PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches (23 Oct 2026)
• TechloMedia — PHP Warns of New Code Execution Vulnerability in Session Upload Progress (24 Oct 2026)
• Threat Landscape — PHP CVE-2026-115560: Disable session.upload_progress.enabled (23 Oct 2026)
• PHP News — PHP Warns of Another Session Upload Progress RCE Path (23 Oct 2026)

For context on this week's PHP security wave: our PHP2Shell patch guide for website owners, CISA's KEV-listed Plex2Shell flaws, and the LiteLLM supply-chain attack cleanup guide.