ON 23 October 2026, PHP disclosed a new session handling flaw, tracked as CVE-2026-115560, that could allow remote code execution in a narrow set of configurations related to session upload progress. The advisory notes the highest reported CVSSv4 score for related issues is 9.2, and while there is no evidence of active exploitation at this time, the weakness ties into an existing attack path used in PHP2Shell activity.
PHP recommends disabling the session upload progress feature as a temporary mitigation: set session.upload_progress.enabled=0 until the next bugfix release.
The vulnerability requires a rare conjunction of factors: an application that configures session.serialize_handler to php_binary or php_serialize, then switches the handler to php at runtime using ini_set() before calling session_start(), while session upload progress remains enabled. PHP stresses that the issue “can only occur under an unusual combination of configuration and application code,” and that applications which never alter the serialize handler at runtime can keep the feature enabled without risk.
At present, there are no public reports of exploitation or a confirmed PoC, and PHP plans a full advisory with the forthcoming release. Acknowledging the broader PHP2Shell incident, the guidance emphasises verifying code paths that mutate the serialize handler at runtime and applying the stated mitigations, with patches forthcoming in PHP releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12.