PHP at a glance
Two days after the PHP2Shell releases, PHP advised turning off session upload progress until its next regular bugfix release, which will carry the full CVE-2026-115560 advisory. Only an unusual configuration is exposed.
PHP: status
- Affected
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (and earlier) when session upload progress is enabled and the session serialize handler is switched to php at runtime
- CVE identifiers
- Status as of
What changed with PHP
On October 23, 2026, the PHP project posted an informational advisory about a remaining, unlikely path to remote code execution that the October 21 releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) do not close. It is tracked as CVE-2026-115560, and PHP says the full advisory will ship with the next regular bugfix release.
The issue needs an unusual mix of settings and code: the configuration sets session.serialize_handler to php_binary or php_serialize, the application switches it to php with ini_set() before calling session_start(), and session upload progress is still enabled. Apps that never change the serialize handler at runtime can leave the feature on. PHP recommends session.upload_progress.enabled=0 in the meantime, the same setting already listed as a mitigation for CVE-2026-109619; anyone who applied it then needs to do nothing more.
How to fix it: PHP
1. Configuration
Set session.upload_progress.enabled=0 until the next regular PHP bugfix release. If you already applied it for CVE-2026-109619, keep it in place.
php.net (opens in a new tab)2. Monitor
Watch php.net for the next bugfix release and the full CVE-2026-115560 advisory, then update.
php.net (opens in a new tab)
Advisories
Why PHP matters for businesses
For businesses this is a follow-up check, not a new emergency. If you manage PHP hosting for clients, confirm whether session upload progress is in use, keep it disabled where possible until the next PHP release, and add that release to your patch calendar.
PHP updates since publication
Dated changes since publication. The original article text above is kept as written on its date.
Status (Updated)Workaround available
CISA added the related CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26, 2026.
cisa.gov (opens in a new tab)
Sources for this story
- Official
- RCE via stale global state (GHSA-6wmf-4rv5-p3rp) (opens in a new tab)Official
php/php-src on GitHub · github.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #php
- #php2shell
- #follow-up