A new security vulnerability in PHP could allow attackers to execute malicious code on certain web servers, even after administrators installed the critical security updates released earlier this week.
The PHP development team issued a security advisory on October 23, 2026, identifying the vulnerability as CVE-2026-115560. Unlike two critical flaws patched on October 21, the newly disclosed issue remains unresolved, although developers say exploitation requires an unusual combination of application settings.
The vulnerability involves PHP’s session upload progress feature, which allows web applications to track file uploads and display progress information to users. The feature is enabled by default, but the security issue does not affect every application using it.
A Specific Configuration Creates the Risk
According to PHP’s advisory, the vulnerability can arise when an application initially configures its session serialization handler as php_binary or php_serialize, then changes that setting to php during execution using ini_set() before calling session_start().
The session upload progress feature must also remain enabled for the vulnerable condition to occur.
This combination is uncommon, substantially limiting the number of applications potentially exposed. PHP says applications that never change their session serialization handler while running can continue using upload progress tracking.
The issue nevertheless presents a potential remote code execution risk. If successfully exploited, such vulnerabilities can allow an attacker to run unauthorized commands on an affected server.
PHP has not yet published a complete technical analysis of CVE-2026-115560.
Recent PHP Security Patches Do Not Fix the New Issue
The disclosure comes two days after PHP released emergency updates addressing CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could enable unauthenticated remote code execution. Those updates introduced PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Cloudflare did confirm that the newly identified vulnerability also affects fully patched PHP installations, including version 8.5.12. Its existing web application firewall protections cover known exploitation attempts against CVE-2026-115560 when websites use PHP’s default upload progress field name. However, that protection does not apply to websites that have customized the session.upload_progress.name setting.
Temporary Protection Available Until a Fix Arrives
PHP recommends temporarily disabling session upload progress by setting: session.upload_progress.enabled=0
The change blocks the identified attack path while developers prepare a permanent fix. Disabling the feature prevents PHP from maintaining session-based upload progress information but does not disable ordinary file uploads.
Administrators should apply the setting through PHP or server configuration before request processing and restart the affected PHP workers to ensure the mitigation takes effect.
The same configuration change was previously recommended as a mitigation for CVE-2026-109619. Organizations that implemented it following the October 21 advisory do not need additional changes for this newly disclosed attack path, provided the protection remains active.
No patch date has been announced, but PHP plans to address the vulnerability in its next regularly scheduled bug-fix release and publish a full security advisory alongside the correction.
Leave a Reply