PHP Warns of New Code Execution Vulnerability in Session Upload Progress

PHP has disclosed a new potential code execution vulnerability, CVE-2026-115560, affecting applications that use a specific combination of session serialization settings and PHP’s session upload progress feature. The project considers the risk unlikely because the vulnerability requires an unusual configuration. It recommends disabling session upload progress until a fix arrives in a routine bugfix release.

According to an informational advisory published on October 23, the issue can occur when an application initially sets session.serialize_handler to php_binary or php_serialize , then switches it to php using ini_set() before calling session_start() . Session upload progress must also be enabled for the vulnerability to apply through this path.

This configuration is the key limitation. Applications that do not change their session serialization handler at runtime are not exposed through this specific attack path, even if session upload progress remains enabled. PHP has not yet published a full technical advisory explaining the vulnerability’s root cause or the precise conditions under which code execution becomes possible.

The recommended mitigation is to set session.upload_progress.enabled=0 . This feature is enabled by default and allows applications to track the progress of file uploads. Administrators who already disabled it following PHP’s earlier security advisory do not need to take further action.

PHP is not issuing an emergency patch for CVE-2026-115560. The project plans to address it in a routine bugfix release and publish a full advisory alongside that release. It has not yet identified the affected PHP versions, specified which releases will contain the fix, or assigned a severity score.

The disclosure follows PHP’s October 21 emergency updates for two critical PHP2Shell vulnerabilities , CVE-2026-109618 and CVE-2026-109619. Those flaws were fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but the updates do not fix CVE-2026-115560. PHP also recommended disabling session upload progress as a mitigation for CVE-2026-109619.

There are no reported exploitation attempts targeting the newly disclosed vulnerability. The attack activity reported in recent days concerns the earlier PHP2Shell flaws, not CVE-2026-115560.

The disclosure comes amid ongoing attempts to exploit the earlier PHP2Shell flaws. Amazon reported that its honeypots recorded an exploit attempt on October 17, four days before public disclosure , while Cloudflare observed attempts rise from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22.

For now, PHP administrators should check their session configuration and disable session upload progress as a precaution.