CompatNav

CVE-2026-115560: PHP’s session upload progress advisory, explained

By CompatNav · Published · Last reviewed · 2 min read

Short answer

On 23 October 2026, two days after the PHP2Shell fixes, php.net published an informational advisory for a related issue, CVE-2026-115560. It suggests setting session.upload_progress.enabled=0 until the next regular PHP release, “to fully protect from an unlikely RCE vector”. It only applies to an unusual setup: code that changes PHP’s session serialiser at run time, with upload progress still enabled. If your host already applied that setting for CVE-2026-109619, nothing more is needed. The full advisory comes with the next regular release.

What php.net published

The informational advisory of 23 October 2026 (php.net):

  • The recommendation: “We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.”
  • The link to the earlier fix: “This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.”
  • Why it’s unlikely: “The issue can only occur under an unusual combination of configuration and application code.”

Who is concerned

php.net spells out the combination: the application “must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start()”, and session upload progress “must also still be enabled”. Its conclusion: “Applications that never change the serialize handler at runtime can keep the feature enabled.” (php.net)

In WordPress terms: WordPress 7.1.2 never starts a PHP session itself, so only a plugin or custom code doing all of the above could be concerned.

What to do

  1. First, the main fix: make sure your PHP runs 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later (how to check).
  2. Ask your host whether session.upload_progress.enabled is set to 0. If they applied it for CVE-2026-109619 on 21 October, nothing more is needed (what to ask).
  3. On your own server, set it in php.ini or the PHP-FPM pool and restart the PHP workers (how).
  4. Watch for the next regular PHP release, which php.net says will come with the full advisory.

How this setting fits with the other mitigations: PHP2Shell mitigations explained.

Key takeaways

  • Published 23 October 2026, as an informational advisory; full details with the next regular release.
  • Recommended setting: session.upload_progress.enabled=0, the same one already advised for CVE-2026-109619.
  • Only an unusual combination of configuration and code is concerned.
  • WordPress itself doesn’t use PHP sessions; a plugin would have to.
  • The October 21 update remains the priority: check that your PHP version is patched.

Frequently asked questions

Is CVE-2026-115560 fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35?

php.net’s advisory doesn’t say it’s fixed: it says the issue is handled in the regular release cycle, with a full advisory at the next release. Until then, the setting is the protection.

Does my WordPress site need the setting?

Only code that switches the session serializer to php at run time is concerned, and WordPress core doesn’t use PHP sessions. Applying the setting is still harmless for WordPress itself; ask your host whether they did.

Who sets it?

Whoever manages PHP: your host on shared or managed hosting, you on your own server, in php.ini or the PHP-FPM pool, followed by a restart of the workers.

Check your own site before you upgrade

CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.

Get CompatNav on wordpress.org How it works

Sources

About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.