PHP session upload progress remote code execution (CVE-2026-115560)

PHP calls CVE-2026-115560 an "unlikely RCE vector" in session upload progress. The feature lets an application follow a file upload through the PHP session, so a page can draw a progress bar. PHP says that in one unusual setup the feature can lead to remote code execution.

PHP has not yet published how the attack works. It will do so in a full advisory with the next regular bugfix release. To follow reports of attacks on CVE-2026-115560, use a vulnerability intelligence platform that tracks exploitation.

Status on 11 November 2026

• PHP has not published the full advisory. The news page at php.net still shows the 23 October note, and PHP says the full advisory comes with the next release.
• There is no fixed version. The latest PHP 8.5 release is 8.5.12 of 21 October, and PHP has not said it fixes this id.
• The PHP security advisories on GitHub have no entry for the id. The newest ones are the two PHP2Shell advisories of 21 October.
• CVE.org returns no record and the NVD has no entry, so there is no CVSS score yet.
• The id is not in the CISA KEV catalog (version 2026.11.10).

The Setup PHP Describes

Three things must be true together. The application sets session.serialize_handler to php_binary or php_serialize in its configuration. It then switches the handler to php at runtime with ini_set() before it calls session_start(). Session upload progress must also still be on, and the PHP manual lists it as on by default.

Applications that never change the serialize handler at runtime can keep the feature on, says PHP. The stopgap it suggests is session.upload_progress.enabled=0 until the next bugfix release.

Public Exploit Code

On 11 November 2026 a GitHub search found 26 repositories that name the id, created between 21 and 31 October. Many are checkers or hardening scripts. At least six describe a proof of concept, a lab or an exploit framework.

Several say the handler switch leads to object injection and then command execution. Those are the authors' claims. We did not run or link any of the repositories. No source we read confirms that an exploit works against a real server.

What Is Not Known Yet

• How the attack works. PHP has not published the details.
• Which PHP versions are affected. PHP gives conditions, not a range.
• The CVSS score and the weakness type, which come with a CVE record.
• Whether any public exploit works outside a lab.
• Which release carries the full advisory. PHP 8.6.0 is planned for 19 November, but PHP has not said it carries the advisory.

How It Differs From PHP2Shell

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's advisory for CVE-2026-109619 already lists turning off upload progress as a mitigation, and that is why the same setting is named again. PHP's note does not say the 21 October releases fix CVE-2026-115560.

Sources differ on which id covers which upload-progress path: VulnCheck ties the upload-progress scans it saw to CVE-2026-109618, while PHP gives CVE-2026-115560 to the serializer switch. Our PHP security news post on CVE-2026-115560 and the PHP2Shell analysis carry the wider story.

A similar mismatch between what a WAF inspects and what the backend uses appears in the ModSecurity multipart filename bypass, CVE-2026-104269.

PHP has not published an affected version range, and the id still had no NVD or CVE program record on 11 November 2026 (we first looked on 23 October). What it has published is a set of conditions, not versions:

• The application configures php_binary or php_serialize as the session serialize handler.
• The application code switches it to php with ini_set() before session_start().
• Session upload progress is enabled.

Who Can Rule Itself Out

PHP says applications that never change the serialize handler at runtime can keep the feature on. Because the trigger lives in application code, the version PHP reports to the outside does not show it. Our free PHP check compares versions for CVE-2026-109618 and CVE-2026-109619 only and does not test this id.

How To Check Your Setup

php -i | grep session.upload_progress.enabled shows the command-line setting. Your web server may load another php.ini, so check the file it uses. To find a handler switch, search the code with grep -rnE "ini_set.*session.serialize_handler" /path/to/app. A match that sets php before session_start() is the case PHP describes.