cyber.hendryadrian.com
Vulnerability & Exploit · cert-agid.gov.it

PHP CVE-2026-115560 Could Enable RCE Under Uncommon Session Configuration

· Original article ↗

Summary

PHP's Security Team says CVE-2026-115560 could enable RCE under an uncommon combination of session settings. No patch was available as of Oct. 24, 2026; disabling session.upload_progress.enabled is the recommended mitigation.

Key points

  • The PHP Security Team disclosed CVE-2026-115560 on Oct. 23, 2026, describing a potential remote code execution issue in PHP session handling.
  • Exploitation requires the handler to start as php_binary or php_serialize, then be changed to php with ini_set() before session_start(), while session.upload_progress is enabled.
  • The PHP Security Team considers this configuration and application behavior combination unlikely; using PHP sessions alone does not mean an application is exposed.
  • The recommended mitigation is to set session.upload_progress.enabled = 0 in the configuration used by the service and restart affected PHP processes.
  • No patch was available as of Oct. 24, 2026; the fix and technical advisory are planned for the next ordinary PHP update.
  • Version-only remote checks cannot determine exposure; administrators should inspect application code and configuration. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address CVE-2026-109618 and CVE-2026-109619, but not CVE-2026-115560.

Article Details

Vulnerability Types
  • PHP session handling vulnerability that may allow remote code execution
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
unavailable
Workarounds
  • Disable upload-progress monitoring by setting session.upload_progress.enabled = 0 in the PHP configuration used by the service, then restart the affected PHP processes.

CVE

CVE-2026-109619A pochi giorni dal rilascio delle correzioni per le vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il PHP Security Team ha comunicato il 23 ottobre 2026 l’esistenza di un’ulteriore problematica nella gestioneCVE-2026-115560La nuova vulnerabilità, identificata come CVE-2026-115560, potrebbe consentire l’esecuzione di codice da remoto (RCE), ma richiede una combinazione poco comune di configurazione del server e comportamento

Products

PHPgiorni dal rilascio delle correzioni per le vulnerabilità critiche CVE-2026-109618 e CVE-2026-109619, il PHP Security Team ha comunicato il 23 ottobre 2026 l’esistenza di un’ulteriore problematica nella gestione

Related Articles