Two days after shipping emergency fixes for the PHP2Shell flaws, the PHP project has told users to switch off one more feature. In an informational advisory published on 23 October, the project recommends setting session.upload_progress.enabled=0 until its next regular bugfix release, "to fully protect from an unlikely RCE vector". The issue is tracked as CVE-2026-115560.
Remote code execution (RCE) means an attacker can run their own commands on the server. That is the same outcome that made PHP2Shell (CVE-2026-109618 and CVE-2026-109619) an update-now event earlier this week, as we reported when PHP pushed out the patches and again when attackers began probing for unpatched servers. The difference is that this one needs a very particular combination of settings and code before it applies at all.
Only an odd session setup is exposed
According to the PHP project, all three of these conditions must hold at the same time:
- the PHP configuration sets
session.serialize_handlertophp_binaryorphp_serialize; - the application then switches that handler to
phpat runtime withini_set(), before callingsession_start(); - session upload progress (
session.upload_progress.enabled) is still turned on.
Applications that never change the serialize handler at runtime are not exposed through this route and can keep upload progress enabled, the project says. Because it judges the setup unlikely in practice, PHP is handling the fix in its normal release cycle rather than with another emergency release, and has said it will publish a full advisory for CVE-2026-115560 alongside that release. At the time of writing no CVE record has been published for the ID.
Peru's Centro Nacional de Seguridad Digital, which relayed the warning in its alert N° 208-2026, notes that the PHP2Shell releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) do not fix this issue, that no affected versions, fixed versions or severity score have been published yet, and that there were no reports of CVE-2026-115560 being exploited when the alert went out.
Set session.upload_progress.enabled=0 and keep it
The fix for now is a single php.ini line: session.upload_progress.enabled=0. That same setting was already listed as a mitigation in PHP's GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619, so teams that applied it during the PHP2Shell scramble should leave it in place and need do nothing further. Teams that only installed the new releases should not assume they are fully covered.
Disabling the feature removes the progress bar some sites show during file uploads, which is a small price on most deployments. Anyone who audits their code and confirms it never calls ini_set() on the session serializer before starting a session can reasonably wait for the regular release. Either way, the lesson of this week stands: the PHP2Shell patch was the start of the cleanup, not the end of it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.