Key facts
Each fact is linked to the source that supports it.- PHP published an informational advisory for CVE-2026-115560 on 23 October 2026. PHP Group
- The recommended control is session.upload_progress.enabled=0, the same setting already listed for CVE-2026-109619. PHP Group
- No fixed release, affected-version list or severity score had been published when the advisory appeared. PHP Group
Summary
PHP describes an unlikely RCE vector that requires an unusual combination of configuration and application code: session.serialize_handler is set to php_binary or php_serialize, then switched to php with ini_set() before session_start(), while session upload progress is enabled. PHP has not published affected versions or a severity score.
Component: PHP core / session upload progress. Disclosed: 23 October 2026. Last verified: 23 October 2026, 13:58 UTC.
Affected versions
| Product | Affected range | Note |
|---|---|---|
| PHP (versions not yet published) | Not specified | PHP has not identified affected versions. This is not a statement that every version is affected. |
Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. PHP Group
Fixed versions
| Product | Fixed version | Note |
|---|---|---|
| PHP | No fixed release yet | PHP plans to handle the issue in the next regular bugfix release and publish a full advisory then. |
No emergency fix. PHP says the issue will be handled in the regular release cycle; the full advisory is pending. PHP Group
Conditions and scope
These are the conditions named by the sources. They are not a score and not a prediction.
- The application sets session.serialize_handler to php_binary or php_serialize in configuration.
- At runtime, application code switches it to php with ini_set() before calling session_start().
- Session upload progress remains enabled.
- Applications that never change the serialize handler at runtime are not exposed through this path, according to PHP.
Exploitation status
No exploitation of CVE-2026-115560 was reported in the sources reviewed. That is an evidence boundary, not proof the issue is unexploitable.
Not present in the downloaded catalog. The catalog predates this advisory, so absence is not an assessment.
Catalog version 2026.10.21 · checked 23 October 2026, 13:52 UTC .
Severity and scoring
Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.
No CVSS score or vector had been published when this record was verified. That is not a low score; it means no score exists to cite.
Scope and separation from PHP2Shell
CVE-2026-115560 is a separate PHP session-handling issue, not a third PHP2Shell CVE. It was disclosed after the 21 October emergency releases and is not fixed by them.
PHP describes the trigger as an unusual combination of configuration and application code. A site that never changes session.serialize_handler at runtime does not meet the stated condition.
Response
Set session.upload_progress.enabled=0 if the application does not rely on upload progress. PHP notes that administrators who applied this setting for CVE-2026-109619 should keep it in place.
Do not treat the new advisory as a reason to delay the PHP2Shell patches. The two PHP2Shell flaws remain the immediate, confirmed RCE risk; this advisory is narrower and has no emergency fix.
What to do
- Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
- Interim controls and their limits — how to buy time without claiming a fix.
- Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.
Sources
Sources for this record
- Full text read
- Metadata only
Last verified 23 October 2026, 13:58 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.