PHP discloses unpatched CVE-2026-115560 in session upload progress
Two days after its 21 October security releases, PHP disclosed a separate, unpatched code execution path that it says needs an unusual setup and will be fixed in the next regular release.
The PHP project published an informational advisory on 23 October 2026 about a new remote code execution issue, CVE-2026-115560, in session upload progress. It is separate from the two flaws (CVE-2026-109618 and CVE-2026-109619) fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and those releases do not fix it.
The required setup
According to PHP, the issue needs an unusual combination of configuration and application code: session.serialize_handler set to php_binary or php_serialize in configuration, then switched to php at runtime with ini_set() before session_start(), with session upload progress still enabled.
PHP's guidance
PHP suggests setting session.upload_progress.enabled=0 until the next regular bugfix release, the same mitigation listed for CVE-2026-109619 on 21 October. PHP says a full advisory will come with that release.
PHP has not said which versions are affected or given a severity score. The Hacker News reports no known exploitation of CVE-2026-115560.