PHP Site AuditPHP security
Why PHP recommends disabling session upload progress after PHP2Shell
PHP's October 21 advisory recommends session.upload_progress.enabled=0 as a temporary measure for a confirmed CVE-2026-109619 path, and its October 23 notice recommends keeping it disabled until the next regular release to cover a newly described, unusual RCE scenario. PHP says the setting reduces specific paths but is not a complete fix for PHP2Shell.
What the setting controls
PHP's session upload progress feature tracks file upload progress and records information in the session. The PHP manual says it is enabled by default. The October 23 informational notice says CVE-2026-115560 requires upload progress to remain enabled plus a specific application sequence: configure session.serialize_handler as php_binary or php_serialize, switch it to php at runtime with ini_set(), and then call session_start().
PHP describes that combination as unusual and suggests setting upload progress to zero until the next regular bug-fix release. Applications that never switch the serialize handler at runtime can keep the feature enabled under the conditions described in the notice, but operators should follow their vendor's update guidance as it evolves.
Apply it where it takes effect
For the October 21 CVE-2026-109619 mitigation, PHP says to set the directive in configuration that applies before request parsing, such as php.ini, an FPM pool, or server configuration. It specifically cautions against relying on application ini_set() or FPM .user.ini for that mitigation. Restart every relevant worker and verify configuration through an administrative channel.
Disabling upload progress may affect an application's upload-progress bar. Check the product's upload workflows and document any user-visible change. Avoid publishing a diagnostic file to confirm the directive; a temporary phpinfo() page can disclose environment and configuration data.
Keep the scope clear
This directive blocks the confirmed session-related path described by PHP; PHP says it does not cover other variants and is not a complete mitigation for CVE-2026-109618 or CVE-2026-109619. Install a vendor-confirmed patched runtime and keep the configuration change as defense in depth until the PHP project or vendor provides updated instructions.
Before applying the temporary setting, identify whether it is controlled globally, per pool or by the hosting provider. Record who changed it, when it takes effect, what upload flow was tested, and when the team will revisit the setting against PHP's next release guidance.
Common questions
Is disabling upload progress the complete PHP2Shell fix?
No. PHP describes it as exposure reduction for specific session paths and says updating the runtime is the complete fix.
Can I set the option in application code?
The documented mitigation must apply before request parsing; ask which startup configuration controls the serving SAPI.
Will the setting affect uploads?
It concerns session upload-progress tracking; test the application's upload flow and consult the host before changing production behavior.