PHP published an informational advisory on 23 October 2026 (10:12 UTC, 6:12 pm Perth) suggesting that users set session.upload_progress.enabled=0 until the next regular bugfix release, 'to fully protect from an unlikely RCE vector', tracked as CVE-2026-115560.

PHP says the issue can only occur under an unusual combination of configuration and application code: an application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(), and session upload progress must also still be enabled.

PHP says applications that never change the serialize handler at runtime can keep the feature enabled. PHP says the same setting was already listed as a mitigation in its GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on 21 October, and that anyone who applied it then should keep it in place and needs to take no further action.

Because the setup is unlikely in practice, PHP says it is handling the issue in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.

According to The Hacker News (23 Oct), the new issue is separate from, and not fixed by, the 21 October releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) that fixed the critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619; PHP has not stated which versions are affected, which releases will contain the fix, or a severity score; and no exploitation of CVE-2026-115560 has been reported. Primary: PHP.net; wire: The Hacker News.

Updated 24 Oct 2026: the CVE number has no published record on cve.org yet, so the card no longer links to one; PHP's own advisory is the primary source. (source: PHP.net)