PHP LTS Security Advisory: CVE-2026-115560 and Recommended Mitigation
The PHP project has published an informational security advisory for CVE-2026-115560, describing a potential remote code execution (RCE) vulnerability involving PHP session handling.
According to upstream, exploiting this vulnerability requires an unusual combination of configuration settings and application behavior, making successful exploitation unlikely in practice. Nevertheless, as a precaution, the PHP project recommends disabling session upload progress until the next regular PHP bugfix release.
Recommended mitigation
To mitigate this issue, disable session upload progress by setting the following directive in your PHP configuration:
session.upload_progress.enabled = 0
Apply this setting through your PHP configuration, such as php.ini or the
relevant PHP-FPM pool configuration. Restart the affected PHP workers as needed
to ensure the change takes effect.
Applications that do not rely on session upload progress should generally be able to disable this feature without affecting their functionality. If your applications use this feature, assess the potential impact before applying the change.
Impact and risk assessment
Upstream has indicated that exploitation requires an unusual combination of session serialization settings and application behavior. Consequently, the exploit scenario is considered unlikely in typical deployments.
However, given the potential severity of remote code execution vulnerabilities, we recommend applying the mitigation as a precaution until a fix becomes available.
If you have already disabled session.upload_progress.enabled as part of the
mitigation for CVE-2026-109619, no additional action is required for this
issue.
Freexian will provide further information to PHP LTS customers as it becomes available.
For organizations that require continued security maintenance for PHP versions beyond their upstream support lifetime, Freexian’s PHP LTS service provides extended security support for legacy PHP deployments.
This article reflects the information available as of October 23, 2026. Please consult the upstream advisory for the latest guidance.