SafetyPublished All news from that day
Ongoing case: Cyber-capable AI models 17 stories
PHP suggests disabling session upload progress; the flaw needs a runtime serialize-handler switch.
A PHP.net notice of 23 October says a setting already listed as a mitigation also guards against a further issue, CVE-2026-115560, whose advisory will follow in the next regular release.
Check our sources · 5 facts from 1 sourceThe PHP project published an informational advisory on 23 October 2026, two days after its critical advisory for CVE-2026-109618 and CVE-2026-109619. It suggests setting session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect against what it calls an unlikely remote code execution vector.
The notice says the issue can occur only when an application sets session.serialize_handler to php_binary or php_serialize and then switches it to php at runtime before calling session_start(), with session upload progress still enabled.
The PHP project says it will publish a full advisory for CVE-2026-115560 with the next release.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 4 of 5 · from PHP Group, 21 Oct 2026
The issue can only occur under an unusual combination of configuration and application code. An application must set `session.serialize_handler` to `php_binary` or `php_serialize` in its configuration and then switch it to `php` at runtime with `ini_set()` before calling `session_start()`. Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 Security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)
Open the source archived copy-
The PHP.net news archive lists an item dated 23 Oct 2026 headed "Informational advisory: Session upload progress", and a security advisory dated 21 Oct 2026 for CVE-2026-109618 and CVE-2026-109619.
cite23 Oct 2026: Informational advisory: Session upload progress
-
The 23 October notice says: "We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector."
citeWe suggest you set `session.upload_progress.enabled=0` until the next regular bugfix release, to fully protect from an unlikely RCE vector.
-
The notice says the setting "was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026."
citeThis setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026.
-
The notice says the issue "can only occur under an unusual combination of configuration and application code": an application must set session.serialize_handler to php_binary or php_serialize and then switch it to php at runtime with ini_set() before calling session_start(), and session upload progress must still be enabled.
citeThe issue can only occur under an unusual combination of configuration and application code. An application must set `session.serialize_handler` to `php_binary` or `php_serialize` in its configuration and then switch it to `php` at runtime with `ini_set()` before calling `session_start()`. Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled.
-
The notice says: "Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release."
citeSince this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · PHP Group · 21 Oct 2026
Security advisory: Critical remote code execution vulnerabilities, update now (21 Oct 2026)
The PHP.net news archive lists an item dated 23 Oct 2026 headed "Informational advisory: Session upload progress", and a security advisory dated 21 Oct 2026 for CVE-2026-109618 and CVE-2026-109619.
23 Oct 2026: Informational advisory: Session upload progress
The 23 October notice says: "We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector."
We suggest you set `session.upload_progress.enabled=0` until the next regular bugfix release, to fully protect from an unlikely RCE vector.
The notice says the setting "was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026."
This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026.
Show all 5 factsShow fewer facts
The notice says the issue "can only occur under an unusual combination of configuration and application code": an application must set session.serialize_handler to php_binary or php_serialize and then switch it to php at runtime with ini_set() before calling session_start(), and session upload progress must still be enabled.
The issue can only occur under an unusual combination of configuration and application code. An application must set `session.serialize_handler` to `php_binary` or `php_serialize` in its configuration and then switch it to `php` at runtime with `ini_set()` before calling `session_start()`. Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled.
The notice says: "Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release."
Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep