https://seclists.org/oss-sec/2026/q4/359: PHP Informational advisory: Session upload progss (CVE-2026-115560)
Affected Software
Frequently Asked Questions
Which applications are exposed to this issue?
Exposure requires an unusual combination: session.upload_progress.enabled must be enabled, the configured session.serialize_handler must be php_binary or php_serialize, and application code must change it to php with ini_set() before calling session_start(). Applications that do not change the serialize handler at runtime are not affected by this condition.
What should teams do before the next PHP bugfix release is available?
Set session.upload_progress.enabled=0 to fully protect against the RCE vector. If this mitigation was already applied for CVE-2026-109619, keep it enabled; no additional action is needed.
Can session upload progress remain enabled?
Yes, applications that never switch session.serialize_handler at runtime can keep session upload progress enabled. The advisory identifies the runtime change from php_binary or php_serialize to php before session_start() as a required condition.