PHP advises safeguards against narrowly exploitable code execution flaw

PHP’s security team has issued mitigation guidance for a newly identified remote code execution vulnerability, CVE-2026-115560, while saying the unusual conditions required for exploitation make widespread exposure unlikely.

The maintainers advised administrators to disable session upload progress until the next scheduled bug-fix release. The vulnerability has not received an emergency patch because exploiting it requires a particular combination of application configuration and runtime behaviour, rather than merely an exposed PHP installation.

The advisory, published on 23 October, recommends setting session. upload_progress. enabled=0. Operators who already applied that measure following an earlier PHP security warning do not need to repeat it, provided the setting remains effective across their installations.

The flaw arises when an application initially configures its session. serializehandler setting as phpbinary or phpserialize, but subsequently changes the handler to php through the iniset() function before invoking session_start(). Session upload progress must also remain enabled for the vulnerable condition to arise.

PHP said applications that never change their session serialisation handler during execution can continue using the upload progress feature. That qualification substantially narrows the affected population, although administrators must examine their own application settings and code before determining whether a deployment is exposed.

Remote code execution vulnerabilities can allow attackers to run instructions on a targeted server. Their practical consequences depend on the permissions of the affected process, the application’s design and the attacker’s ability to satisfy the necessary conditions. The PHP announcement did not establish that CVE-2026-115560 had been exploited against production systems.

The PHP project plans to publish a fuller security advisory alongside its next regular release. Its initial notice did not specify a definitive affected-version range or provide a final severity score, leaving administrators dependent on configuration checks and the temporary mitigation while awaiting further technical information.

Bangladesh’s e-Government Computer Incident Response Team issued an alert on 27 October describing the flaw as a potential remote code execution risk under the specified conditions. It recommended applying the configuration change, restarting relevant PHP workers and testing applications that depend on upload progress functionality.

Malaysia’s national computer emergency response team, MyCERT, also distinguished the new issue from two other PHP vulnerabilities disclosed earlier in October. Its assessment said the latest flaw would be addressed through the normal release cycle rather than through another emergency security update.

Those earlier vulnerabilities, CVE-2026-109618 and CVE-2026-109619, prompted PHP to release security updates on 21 October. The project issued PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical weaknesses, which could permit unauthenticated remote code execution under certain circumstances.

The new vulnerability is separate and is not fixed by those October updates. PHP had already recommended disabling session upload progress as one defensive measure against CVE-2026-109619, explaining why organisations that followed the earlier guidance may already have protection against the newly disclosed attack path.

Amazon Web Services said its PHP application managed rules, version 2.4 and later, already block certain requests carrying both a PHP session identifier and the upload progress field. The company said this offers mitigation for CVE-2026-115560 without requiring another update to that rule group.

CloudLinux, which supplies PHP packages for hosting environments, said in guidance dated 27 October that no fix for the new vulnerability had been included in the packages it examined. Its guidance identified the default session serialisation handler as php, which does not by itself satisfy the exploit conditions.

CloudLinux advised operators of affected configurations to disable upload progress through the relevant PHP settings and restart the PHP processes. It noted that doing so stops upload progress indicators from functioning but does not prevent files themselves from being uploaded.

The distinction matters for hosting providers running multiple websites under different PHP configurations. A server-wide setting may not establish whether individual applications change serialisation handlers dynamically, making code-level checks important when assessing the specific vulnerability.

For installations using PHP-FPM or other persistent worker processes, the revised configuration must be loaded by running workers before the safeguard takes effect. PHP has warned against relying on an application-level ini_set() change for the earlier session-related mitigation because request processing may begin beforehand.

PHP’s earlier guidance on the October security releases also cautioned that configuration-based protections against the two preceding vulnerabilities were incomplete substitutes for installing patched software. Administrators therefore need to distinguish the temporary safeguard for CVE-2026-115560 from the separate updates required to address CVE-2026-109618 and CVE-2026-109619.