PHP has disclosed an unpatched issue in session upload progress and serialization handling that could allow attackers to remotely execute malicious code under a specific combination of application code and session configuration.

In this blog, we break down the flaw, the probable threat it poses, and the mitigation steps organizations should use.

About the vulnerabilities

PHP disclosed the flaw on 23rd October 2026 and has reported that it is unlikely to be exploited in typical configurations. The company has also planned to fix it in its regular security update release.

PHP has a feature that tracks the progress of file uploads and stores this information in the user’s session. PHP uses these sessions to remember information about the users as they interact with a website. It has another feature used to track the progress of file uploads.

This flaw occurs when session data is incorrectly processed due to a specific combination of settings.

An attacker can use the flaw to run malicious code on the server.

The flaw does not affect every website since it works only under very specific conditions.  

What could attackers do with the vulnerability?

If successfully exploited in a susceptible configuration, the vulnerability could allow an attacker to execute code on the affected server. The potential consequences depend on the application’s configuration, exposure, and the privileges available to the PHP process.

With the access and permissions needed, attackers can:

• Execute malicious code on the affected server.
• Access sensitive data accessible to the compromised PHP process.
• Modify files or data that the compromised process has permission to change.
• Install malware if the server conditions are met.

Note:

Except for malicious code execution on the affected server, which is confirmed by PHP, these are general consequences of the RCE.

Official mitigation guidance

PHP has not yet published a confirmed affected-version range for CVE-2026-115560. Organizations should review their PHP deployments and monitor the official advisory for updates.

• Temporary mitigation: Set session.upload_progress.enabled=0 in the server-side PHP configuration and restart the relevant PHP workers.
• PHP-FPM and Apache: Apply the setting through an administrative configuration that application code cannot override. Verify that the setting is effective in the PHP runtime serving the application, not just the command-line PHP environment.
• Existing mitigation: Organizations that already disabled session upload progress for the previous PHP security advisory should keep the setting in place.
• Patch status: The issue is scheduled for a future regular bug-fix release. Keep the mitigation enabled until the appropriate fix is available and its deployment is verified.

SharkStriker’s Recommendations:

• Apply the official temporary mitigation by disabling session upload progress and restarting the relevant PHP workers.
• Identify PHP-based applications across internet-facing servers, internal systems, and products that embed PHP.
• Review application code and configuration for the specific session-handler sequence associated with the vulnerability.
• Monitor official PHP security advisories for the full technical disclosure and future fixes.
• Validate the mitigation on the PHP runtime actually serving production traffic.
• Maintain monitoring for suspicious server-side execution and investigate anomalous activity promptly.