---
title: PHP issues a new informational advisory, CVE-2026-115560: an unlikely RCE path through session upload progress that the PHP2Shell releases don't fix; set session.upload_progress.enabled=0 | ctxsec
url: https://ctxsec.com/items/php-cve-2026-115560-session-upload-progress-advisory
description: ""
status: "confirmed (php.net informational advisory, Oct 23; no fix, versions or score yet; no exploitation reported)"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/php-cve-2026-115560-session-upload-progress-advisory.md)

confirmed (php.net informational advisory, Oct 23; no fix, versions or score yet; no exploitation reported)

2026-10-23

### PHP issues a new informational advisory, CVE-2026-115560: an unlikely RCE path through session upload progress that the PHP2Shell releases don't fix; set session.upload_progress.enabled=0

Two days after the PHP2Shell emergency releases, the PHP project posted an **informational advisory** on **Oct 23** about another remote code execution vector, tracked as **CVE-2026-115560**. It is separate from CVE-2026-109618/109619, and 8.5.12, 8.4.27, 8.3.36 and 8.2.35 do not fix it.

- **Who is exposed:** only applications that set `session.serialize_handler` to `php_binary` or `php_serialize` in configuration, then switch it to `php` at runtime with `ini_set()` before calling `session_start()`, while session upload progress is still enabled. PHP calls this setup unlikely in practice.
- **Mitigation:** set `session.upload_progress.enabled=0` until the next regular bugfix release. It is the same setting PHP already listed as a mitigation in the CVE-2026-109619 advisory (GHSA-6wmf-4rv5-p3rp) on Oct 21, so if you applied it then, keep it in place.
- **Not yet published:** affected versions, fixed releases and a severity score. PHP will publish a full advisory with the next regular release rather than shipping an emergency fix.

No exploitation of CVE-2026-115560 has been reported. The in-the-wild activity since Oct 21 targets the two earlier PHP2Shell CVEs, so patching those is still the priority.

Sources: [php.net: Informational advisory: Session upload progress (Oct 23)](https://www.php.net/archive/2026.php#2026-10-23-1) · [PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, lists the same mitigation)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) · [The Hacker News: PHP warns of another unpatched RCE (Oct 23)](https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html)