The notice says the issue "can only occur under an unusual combination of configuration and application code": an application must set session.serialize_handler to php_binary or php_serialize and then switch it to php at runtime with ini_set() before calling session_start(), and session upload progress must still be enabled.

The exact words it rests on

The issue can only occur under an unusual combination of configuration and application code. An application must set `session.serialize_handler` to `php_binary` or `php_serialize` in its configuration and then switch it to `php` at runtime with `ini_set()` before calling `session_start()`. Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled.

What the source said when we opened it, on 26 Oct 2026.

The source

Security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)
PHP Group · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 26 Oct 2026, against the source above.

In the story

PHP suggests disabling session upload progress; the flaw needs a runtime serialize-handler switch. 26 Oct 2026