The PHP Foundation discloses new vulnerabilities that have not yet been fixed and provides mitigation solutions but will not release new versions to fix them for the time being.

Abstract:

The PHP Foundation issued an announcement on October 24 disclosing the risk of a remote code execution vulnerability numbered CVE-2026-115560. However, this vulnerability will not be fixed by releasing a new version for the time being, because the vulnerability requires a specific combination of configuration and application code to be triggered, which means that the harm is relatively not that high.

According to the current known situation, this vulnerability needs to meet multiple conditions at the same time to trigger: the application configuration sets session.serialize_handler to php_binary or php_serialize, then switches it to php through ini_set() at runtime, and calls session_start() after the switch. At the same time, session.upload_progress.enabled also needs to be enabled.

session.serialize_handler is used to control the serialization format used by PHP when reading and writing session data. PHP says that if the application does not switch to this processor while running, it can continue to use the upload progress function. Officials evaluate this configuration combination as a relatively rare situation in actual applications.

Temporary mitigation plan:

The latest vulnerability is different from the PHP2Shell vulnerability that was fixed in a new version of PHP earlier. Since the triggering method of this vulnerability is relatively rare, the PHP Foundation temporarily provides a mitigation solution for potentially affected developers. A new version will be released later to completely fix it.

The PHP Foundation recommends that affected users set session.upload_progress.enabled to 0 and keep this setting until a regular release containing the fix is ​​installed. Environments that have previously turned off upload progress do not need to make repeated adjustments.