---
title: Tip: after patching PHP2Shell, turn off session upload progress (session.upload_progress.enabled=0) and check for runtime serialize_handler switches | ctxsec
url: https://ctxsec.com/items/tip-php-disable-session-upload-progress
description: ""
status: "guidance from PHP's Oct 23 informational advisory"
published: 2026-10-23
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-php-disable-session-upload-progress.md)

guidance from PHP's Oct 23 informational advisory

2026-10-23

### Tip: after patching PHP2Shell, turn off session upload progress (session.upload_progress.enabled=0) and check for runtime serialize_handler switches

- **Set it:** add `session.upload_progress.enabled=0` to php.ini (or the FPM pool's `php_admin_flag`), then reload PHP-FPM or Apache. Confirm with `php -i | grep upload_progress` for CLI and a `phpinfo()` check, or `ini_get()`, for each web SAPI, because CLI and FPM often read different ini files.
- **Containers and appliances:** bake the setting into base images, since a running-container change won't survive a redeploy.
- **Find the risky pattern:** search your code for `ini_set('session.serialize_handler'` (and `ini_set("session.serialize_handler"`). PHP says only apps that change the handler to `php` at runtime are exposed to CVE-2026-115560.
- **Side effect:** upload progress bars that rely on `$_SESSION` upload-progress keys will stop updating. Most apps don't use the feature.
- **Don't skip the real patch:** this setting doesn't fix CVE-2026-109618, so 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro's backport) is still required.

Sources: [php.net: Informational advisory: Session upload progress (Oct 23)](https://www.php.net/archive/2026.php#2026-10-23-1) · [php.net: Oct 21 security advisory for CVE-2026-109618/109619](https://www.php.net/archive/2026.php)