PHP Site AuditPHP security
CVE-2026-115560: what PHP's October 23 session advisory actually says
On October 23, 2026, PHP published an informational notice for CVE-2026-115560. It recommends session.upload_progress.enabled=0 until the next regular bug-fix release. The described path requires upload progress plus an uncommon runtime switch of the session serialization handler before session_start(); PHP says applications that never make that runtime switch can keep upload progress enabled.
The preconditions matter
PHP's notice does not say every PHP application is exposed in the same way. It describes an unusual combination: application configuration starts with session.serialize_handler set to php_binary or php_serialize, code changes the handler to php using ini_set() at runtime, that change happens before session_start(), and session upload progress remains enabled.
The notice says a full advisory will arrive with the next release. Until then, PHP's recommended temporary configuration is to disable session upload progress. Keep the exact scope clear when explaining the notice: do not turn a conditional path into a claim that every PHP session is exploitable.
What site teams should do
Ask the application team whether code changes session.serialize_handler at runtime and whether upload progress is required. If practical, disable the directive at the server or pool configuration level and restart the relevant workers, then test file upload behavior. The PHP manual describes upload progress as a feature for tracking uploads; turning it off may remove progress reporting while leaving uploads themselves working, depending on the application.
If the team already disabled this setting in response to PHP's October 21 advice for CVE-2026-109619, PHP says the October 23 recommendation requires no further action on that point. Still verify the deployed runtime fix for the October 21 flaws: a setting is not a replacement for a patch.
How to communicate the advisory
A useful internal update names the CVE, the date and exact preconditions described by PHP, the affected app or pool if confirmed, and the action taken. Label anything still being checked as unknown. Follow PHP's archive or the provider's security bulletin for the next release and full advisory; early write-ups should not be treated as a substitute for that primary source.
Common questions
Does CVE-2026-115560 affect every PHP application?
PHP describes an uncommon combination of serializer configuration, a runtime switch before session_start(), and upload progress left enabled.
Is this one of the two October 21 CVEs?
No. PHP published it as a separate October 23 informational follow-up and plans a full advisory with the next release.
What does PHP recommend now?
Disable session upload progress until the next regular bug-fix release; keep the October 21 package update as a separate priority.