PHP has disclosed another potential Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-115560, involving Session Upload Progress handling.
The vulnerability requires an unusual combination of session serialization settings and application code, but could allow remote code execution under specific conditions.
Immediate Mitigation:
Disable Session Upload Progress in PHP configuration:
session.upload_progress.enabled = OffThis disables upload progress tracking, not regular file uploads.
PHP recommends keeping this mitigation enabled until the next regular bug-fix release. Administrators who already applied it while addressing PHP2Shell (CVE-2026-109619) do not need to take further action.
Read our technical analysis and mitigation guide:
PHP CVE-2026-115560: Vulnerability Analysis and Mitigation
CVE: CVE-2026-115560
Reference: Official PHP Security Advisory