PHP session upload progress remote code execution (CVE-2026-115560)

PHP calls CVE-2026-115560 an "unlikely RCE vector" in session upload progress. The feature lets an application follow a file upload through the PHP session, so a page can draw a progress bar. PHP says that in one unusual setup the feature can lead to remote code execution. PHP has not yet published how the attack works. It will do so in a full advisory with the next regular bugfix release.

The Setup PHP Describes

Three things must be true together. The application sets session.serialize_handler to php_binary or php_serialize in its configuration. It then switches the handler to php at runtime with ini_set() before it calls session_start(). Session upload progress must also still be on, and the PHP manual lists it as on by default.

Applications that never change the serialize handler at runtime can keep the feature on, says PHP. The stopgap it suggests is session.upload_progress.enabled=0 until the next bugfix release.

Claims From Public Repositories

On 23 October, six public GitHub repositories named the id. The newest, created at 18:31 UTC, says it holds a lab on PHP 8.5.12 where the handler switch leads to object injection and then command execution. That is the author's claim, and we have not verified it. The same text says no CVSS score, weakness type or affected range had been published. We did not run or link any of the repositories.

How It Differs From PHP2Shell

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's advisory for CVE-2026-109619 already lists turning off upload progress as a mitigation, and that is why the same setting is named again. PHP's note does not say the 21 October releases fix CVE-2026-115560. Sources differ on which id covers which upload-progress path: VulnCheck ties the upload-progress scans it saw to CVE-2026-109618, while PHP gives CVE-2026-115560 to the serializer switch. Our PHP security news post on CVE-2026-115560 and the PHP2Shell analysis carry the wider story.

PHP has not published an affected version range, and the id had no NVD or CVE program record when we looked at 18:42 UTC on 23 October. What it has published is a set of conditions, not versions:

• The application configures php_binary or php_serialize as the session serialize handler.
• The application code switches it to php with ini_set() before session_start().
• Session upload progress is enabled.

Who Can Rule Itself Out

PHP says applications that never change the serialize handler at runtime can keep the feature on. Because the trigger lives in application code, the version PHP reports to the outside does not show it. Our free PHP check compares versions for CVE-2026-109618 and CVE-2026-109619 only and does not test this id.