PHP vulnerability CVE-2026-115560

It has been suggested to set session.upload_progress.enabled=0 until the next regular bug-fix release, in order to ensure full protection against an unlikely RCE (remote code execution) vector. This configuration was previously recommended as a mitigation measure in security advisory GHSA-6wmf-4rv5-p3rp, pertaining to CVE-2026-109619 (published on October 21, 2026). If you have already implemented this measure, please keep it in place; no further action is required.

The issue can only occur under an unusual combination of configuration and application code. It requires the application to set session.serialize_handler to php_binary or php_serialize in its configuration, and subsequently change this value to php during execution (at runtime) using ini_set(), prior to calling session_start(). Furthermore, the session upload progress feature must be enabled. Applications that do not change the serialize_handler during runtime may keep this feature enabled. As this scenario is unlikely in practice, we are addressing the matter within our regular release cycle and will publish a full security advisory regarding CVE-2026-115560 alongside the next update.