K000163878: PHP vulnerability CVE-2026-115560

My.F5 • October 24, 2026

Statement from : We suggest you set session.upload_progress.enabled=0 until the regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed. The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the release. ( CVE-2026-115560 )

For products with None in the Versions known to be vulnerable column, there is no impact.

For products with ** in the various columns, F5 is still researching the issue and will update this article after confirming the required information. F5 Support has no additional information this issue.

Security Advisory Status

To determine if your product and version have been evaluated for this vulnerability, refer to the Evaluated products box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information releases, point releases, or hotfixes that address the vulnerability, refer to the following tables. You can also use iHealth to diagnose a vulnerability for BIG-IP, BIG-IQ, and F5OS systems. For more information using iHealth, refer to K27404821: Using F5 iHealth to diagnose vulnerabilities . For more information security advisory versioning, refer to K51812227: Understanding security advisory versioning .

BIG-IP, BIG-IQ, and F5 Insight

F5 Distributed Cloud and NGINX Services

1 F5 evaluates only software versions that have not yet reached the End of Technical Support (EoTS) phase of their lifecycle. For more information, refer to the Security hotfixes section of K4602: Overview of the F5 security vulnerability response policy .

BIG-IP, BIG-IQ, and F5 Insight

Note : After a fix is introduced for a given minor branch, that fix applies to all subsequent maintenance and point releases for that branch, and no additional fixes for that branch will be listed in the table. For example, when F5 releases a fix in 17.1.2.1, the fix also applies to 17.1.2.2 and all later 17.1.x releases (17.1.3.x, 17.1.4.x). For more information, refer to K51812227: Understanding security advisory versioning .

2 Starting with the August 2024 Quarterly Security Notification, F5 will provide the CVSS v4.0 base score in addition to the CVSS v3.1 score, for first-party security issues only. The CVSS score link takes you to a resource outside of MyF5, and the content may be removed without our knowledge. For more information how F5 uses CVSS v4.0, refer to K000140363: Overview of CVSS v4.0 in F5 security advisories .

**Confirmation of vulnerability or non-vulnerability is not presently available. F5 is still researching the issue for the products indicated and will update this article with the most current information as soon as it has been confirmed. F5 Support has no additional information on this issue.

F5 Distributed Cloud and NGINX Services

Security Advisory Recommended Actions

F5 is still researching the issue for the products indicated and will update this article with the most current information as soon as it has been confirmed. F5 Support has no additional information on this issue.

The following mitigates BIG-IP control plane configuration utility exposure as well as BIG-IP APM data plane exposure.

At a high level, the admin needs to login on BIG-IP with advanced shell, create a new file with the content below, and restart apache.

Important : F5 recommends that you verify the following php.ini configuration in your testing/staging environment before deploying to your production environment.

Note : If you have a multi bladed system these steps must be done on each individual blade.

Create a new file - /etc/php.ini.d/K000163878.ini and include the content below. ; The configuration mitigations recommended by PHP for CVE-2026-115560 ; These will NOT survive an upgrade of BIG-IP TMOS. session.upload_progress.enabled = 0

; The configuration mitigations recommended by PHP for CVE-2026-115560 ; These will NOT survive an upgrade of BIG-IP TMOS. session.upload_progress.enabled = 0

Restart apache using bigstart restart httpd . On multi-bladed systems, restart apache using clsh bigstart restart httpd .

On multi-bladed systems, restart apache using clsh bigstart restart httpd .

Only for BIG-IP APM systems, restart apache using bigstart restart httpd_sam . On multi-bladed BIG-IP APM restart apache using clsh bigstart restart httpd_sam . Note : Restarting the httpd_sam process may disrupt webtop connections, requiring users to reconnect.

On multi-bladed BIG-IP APM restart apache using clsh bigstart restart httpd_sam .

Note : Restarting the httpd_sam process may disrupt webtop connections, requiring users to reconnect.

If you have configured a device group, repeat on each high availability (HA) peer in the group.

K41942608: Overview of MyF5 security advisory articles

K12201527: Overview of F5 security notifications

K51812227: Understanding security advisory versioning

K4602: Overview of the F5 security vulnerability response policy

K4918: Overview of the F5 critical issue hotfix policy

K000138061: Overview of the F5OS critical issue hotfix policy

K39757430: F5 product and services lifecycle policy index

K9957: Creating a custom RSS feed to view new and updated documents

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure. 277 sources 73

Extracted Entities

K000163878: PHP vulnerability CVE-2026-115560

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (4)

Tools (1)