PHP CVE-2026-115560 Fix: What Website Owners Need to Change

Updating PHP to its latest security release may not be enough to close every newly identified route to remote code execution. On October 23, 2026, the PHP security team disclosed CVE-2026-115560, a potential vulnerability involving session handling and upload-progress tracking, just two days after releasing emergency fixes for two critical PHP flaws. The new issue requires an unusual combination of application code and configuration, and PHP has recommended a temporary setting change while a permanent fix is prepared.

Why the new PHP vulnerability matters after the emergency patches

PHP is a server-side programming language used to build websites and web applications. Its code runs on a server when a visitor submits a form, signs in, uploads a file or requests dynamic content. A vulnerability in the PHP runtime can therefore affect multiple applications hosted on the same server, even when those applications use different content management systems or frameworks.

The new advisory follows two critical vulnerabilities disclosed on October 21: CVE-2026-109618 and CVE-2026-109619, collectively associated with the PHP2Shell incident. Those flaws can allow an unauthenticated attacker, meaning someone who does not need a legitimate account, to execute code remotely on a vulnerable server. PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

CVE-2026-115560 is a separate issue. The PHP team says it can arise only when an application uses a particular combination of session serialization settings, changes those settings while running, and leaves session upload progress enabled. The October 21 releases do not resolve this additional issue, so administrators need to check both their PHP version and the relevant configuration.

Which PHP configurations can trigger CVE-2026-115560?

The vulnerability involves PHP sessions, which allow a website to retain information about a visitor between requests. Session serialization is the process of converting session data into a format that PHP can store and later reconstruct. Upload-progress tracking is a feature that can record information about an ongoing file upload, allowing an application to display progress to the visitor.

According to the PHP security team's October 23 advisory, the potential code-execution path requires all of the following conditions:

\
• The application initially configures session.serialize_handler as php_binary or php_serialize.
\
• The application changes the serialization handler to php at runtime using ini_set().
\
• That change happens before the application calls session_start().
\
• Session upload-progress tracking remains enabled.

These requirements matter because the advisory does not describe every PHP website as equally exposed. An application that never changes its session serialization handler at runtime does not meet the stated conditions for this attack path. However, administrators should not assume their sites are safe simply because they use a familiar content management system; custom plugins, application code and hosting configurations can change how PHP behaves.

The recommended temporary fix is to disable session upload progress

PHP recommends setting session.upload_progress.enabled=0 until a regular bug-fix release addresses CVE-2026-115560. This disables the upload-progress feature responsible for the additional exposure described in the advisory. The recommendation is a temporary mitigation, not confirmation that a permanent software fix is already available.

Administrators should make the change in the PHP configuration used by the affected application. Depending on the hosting environment, that configuration may be managed through a hosting control panel, a server configuration file, a container image or the hosting provider itself. The precise location varies, so the setting should be changed in the configuration actually used by the web-serving PHP process rather than only in a command-line configuration that may be different.

After changing the configuration, verify that the web server's PHP processes are using the updated setting. Depending on the deployment, this may require restarting or recycling PHP workers or the relevant web service. Test any application features that depend on upload-progress reporting, because disabling the feature can stop progress indicators from receiving the information they expect.

Website owners must still install the PHP2Shell security releases

Disabling upload progress does not replace the security updates released on October 21. Those updates address the separate PHP2Shell vulnerabilities, and systems running older vulnerable releases should be upgraded to a fixed version. The PHP project identifies the following patched releases:

PHP 8.1 and older branches require particular attention because they are no longer supported by the main PHP release process. Administrators should check whether their operating system vendor or hosting provider supplies a security backport, which applies a security fix to an older software branch, or move to a supported PHP version. A version number alone may not tell the whole story when a vendor has backported a patch without changing the upstream version string.

For websites running WordPress, Drupal, Joomla or another PHP-based application, the relevant PHP version is the one used by the website's hosting environment. Updating a local development installation does not protect a production server. Likewise, updating the application or its plugins is not a substitute for upgrading the underlying PHP runtime.

How to check whether your website is protected

Start by identifying the PHP version used by each website and application. If you manage the server, the php -v command can show the command-line PHP version, but it does not always match the version used by the web server. Hosting customers should check their provider's PHP settings or ask the provider to confirm the runtime version and whether the October 21 security patches have been applied.

Next, review the active PHP configuration for session.upload_progress.enabled. If the setting is enabled, disable it as recommended while the new issue awaits a permanent fix. Where you manage application code, check whether it changes session.serialize_handler using ini_set() before starting a session. This review helps establish whether the unusual configuration described in the advisory exists in your application.

Finally, confirm that the security updates are active in the production environment, restart or recycle affected workers where required, and review server logs for unusual PHP worker crashes, memory errors or unexpected processes. Because the earlier PHP2Shell flaws have a different attack path, applying the new configuration mitigation alone is not enough to declare an unpatched installation secure.

What remains unknown about the new vulnerability

As of October 24, the PHP team's public notice describes CVE-2026-115560 as an unlikely remote-code-execution vector that depends on unusual application behaviour. The team has not announced an emergency release for this issue; it plans to publish a full advisory with a regular bug-fix release. Administrators should therefore avoid treating the temporary setting change as a permanent resolution or assuming that a specific release date has been confirmed.

The disclosure also needs to be distinguished from evidence of exploitation. The existence of a vulnerability does not by itself establish that attackers are actively exploiting it, and the available advisory does not confirm exploitation of CVE-2026-115560. That uncertainty is not a reason to ignore the mitigation, particularly on internet-facing servers that process untrusted requests.

For website owners, the practical priority is clear: keep PHP on a security-fixed release, disable session upload progress until the new issue is addressed, and verify the configuration on the actual production runtime. Watch for the PHP project's next regular release and full advisory, then apply the permanent fix when it becomes available. Until then, a patched PHP version and the recommended configuration change address two distinct parts of the problem rather than one.