[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance from PHP's Oct 23 informational advisory

Tip: after patching PHP2Shell, turn off session upload progress (session.upload_progress.enabled=0) and check for runtime serialize_handler switches

  • Set it: add session.upload_progress.enabled=0 to php.ini (or the FPM pool's php_admin_flag), then reload PHP-FPM or Apache. Confirm with php -i | grep upload_progress for CLI and a phpinfo() check, or ini_get(), for each web SAPI, because CLI and FPM often read different ini files.
  • Containers and appliances: bake the setting into base images, since a running-container change won't survive a redeploy.
  • Find the risky pattern: search your code for ini_set('session.serialize_handler' (and ini_set("session.serialize_handler"). PHP says only apps that change the handler to php at runtime are exposed to CVE-2026-115560.
  • Side effect: upload progress bars that rely on $_SESSION upload-progress keys will stop updating. Most apps don't use the feature.
  • Don't skip the real patch: this setting doesn't fix CVE-2026-109618, so 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro's backport) is still required.

Sources: php.net: Informational advisory: Session upload progress (Oct 23) · php.net: Oct 21 security advisory for CVE-2026-109618/109619