PHP Flags a Narrow Remote Code Execution Risk in Session Settings
Photo: TokenPost
PHP flagged a separate, unlikely remote-code-execution (RCE) path on Oct. 23, tied to an uncommon session configuration, following patches for two critical web-facing flaws released two days earlier. Identified as CVE-2026-115560, the new path involves an application setting session.serialize_handler to php_binary or php_serialize, changing it to php with ini_set() before session_start(), and leaving session upload progress enabled. PHP recommended setting session.upload_progress.enabled=0 until its next regular bug-fix release. The notice describes a narrow configuration condition and does not state that every PHP site is vulnerable to this path. The advisory follows the Oct. 21 release of fixes for CVE-2026-109618 and CVE-2026-109619.
Source: TokenPost
