{"schema_version":"1","data":[{"id":19314,"advisory_id":"9c427ccc-d6f1-4a1b-9097-c6e6d543e120","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/359","source_published_at":"2026-10-23T16:41:37+00:00","published_at":"2026-10-25T02:31:22.125833+00:00","extraction_method":"llm","technologies":["oss-security","php"],"cve_ids":["CVE-2026-115560"],"event_types":["mitigation"],"payload":{"kind":"mitigation","title":"PHP Informational advisory: Session upload progress (CVE-2026-115560)","summary":"PHP advises disabling session upload progress until the next regular bugfix release to mitigate an unlikely RCE vector. The issue requires a specific runtime session serialization-handler change and session upload progress to remain enabled.","evidence":"We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.","products":[{"name":{"value":"PHP","evidence":"PHP Informational advisory: Session upload progress"},"prerequisites":[{"value":"session.serialize_handler to php_binary or php_serialize","evidence":"An application must set session.serialize_handler to php_binary or php_serialize in its configuration"},{"value":"switch it to php at runtime with ini_set() before calling session_start()","evidence":"then switch it to php at runtime with ini_set() before calling session_start()"},{"value":"Session upload progress must also still be enabled","evidence":"Session upload progress must also still be enabled"}],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-115560","evidence":"CVE-2026-115560"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19314,"next_before":19314}