PHP Flags New Remote Code Execution Path and Urges Users to Disable Upload Progress
Photo: TokenPost
PHP maintainers disclosed a separate, unlikely remote code execution path Friday, urging operators to disable session upload progress until the next regular bug-fix release to reduce exposure. The issue, CVE-2026-115560, involves an unusual setup: an application uses php_binary or php_serialize for session serialization, switches to php at runtime before starting a session, and leaves upload progress enabled. PHP advised setting session.upload_progress.enabled=0 until the next regular bug-fix release. Operators who already disabled upload progress to mitigate CVE-2026-109619 do not need another change for this issue.
Source: TokenPost
