Web Security

PHP CVE-2026-115560 Follow-Up: If You Patched Tuesday. You’re Already Covered

Aaron with AI Assist October 23, 2026 2 min read 46 views
Application Security Secure Code Vulnerability Management
Web Security

A brief follow-up to Tuesday's PHP security post.

The PHP project published an informational advisory today for a third CVE — CVE-2026-115560 — related to session upload progress handling. The short version: if you applied the October 21 mitigations, you are already covered. No emergency action is needed.

What CVE-2026-115560 Is

The vulnerability involves a serialize-handler switch during upload progress processing. Exploitation requires three conditions to exist simultaneously: the application must set session.serialize_handler to php_binary or php_serialize in its configuration, then switch it back to php at runtime via ini_set() before calling session_start(), and session.upload_progress.enabled must still be on.

PHP's advisory describes this combination as unlikely in practice. Most applications do not switch serialize handlers at runtime.

What This Means If You Patched Tuesday

The October 21 advisory for CVE-2026-109619 already listed session.upload_progress.enabled=0 as a mitigation. If you applied that setting — either as a mitigation while patching or as part of your post-patch hardening — CVE-2026-115560 is already mitigated. No further action is needed until the next regular bugfix release, which will include a proper fix.

If you patched to PHP 8.4.27, 8.3.36, 8.2.35, or 8.5.12 but did not apply session.upload_progress.enabled=0, and your application switches serialize handlers at runtime, add the following to your php.ini (or FPM pool / Apache configuration — not via ini_set()) and restart your web server:

session.upload_progress.enabled=0

The Fix Timeline

PHP is handling CVE-2026-115560 in the regular release cycle — not an emergency release. A full advisory will be published with the next scheduled bugfix release. The PHP project classified this as informational specifically because the attack surface is narrow and the mitigation was already distributed.

Key Links