PHP Informational advisory: Session upload progress (CVE-2026-115560)
PHP advises disabling session upload progress until the next regular bugfix release to mitigate an unlikely RCE vector. The issue requires a specific runtime session serialization-handler change and session upload progress to remain enabled.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.
PHP
PHP Informational advisory: Session upload progress
- Affected versions
- Not stated in this extraction
- Fixed versions
- Not stated in this extraction
- Prerequisites
- session.serialize_handler to php_binary or php_serialize
An application must set session.serialize_handler to php_binary or php_serialize in its configuration
switch it to php at runtime with ini_set() before calling session_start()then switch it to php at runtime with ini_set() before calling session_start()
Session upload progress must also still be enabledSession upload progress must also still be enabled
- Related CVEs
- CVE-2026-115560
CVE-2026-115560
Publisher severity
No explicit severity was extracted.