PHP shares mitigation for new RCE vulnerability with no patch

CVE-2026-115560 is a remote code execution vulnerability in PHP that can be exploited only when an application uses a non-default configuration: specifically, when session.serialize_handler is initially set to php_binary or php_serialize and then changed at runtime to php via ini_set() before session_start(), with session upload progress enabled. The PHP security team has not yet released a patch but advises disabling session.upload_progress.enabled as a temporary mitigation. This vulnerability is separate from the recently patched PHP2Shell RCE vulnerabilities. The PHP team plans to include a full advisory and patch in the next regular release cycle.

The vulnerability allows remote code execution but only under a very specific and uncommon configuration scenario. Systems with default or typical PHP configurations are not affected. No known exploits or successful attacks have been reported. The impact is limited to environments that dynamically switch session serialization handlers at runtime while having session upload progress enabled.

The PHP security team recommends setting session.upload_progress.enabled=0 to mitigate the vulnerability until an official patch is released. If this setting has already been applied, no further action is needed. The PHP team plans to address this vulnerability in the next regular release cycle. Administrators should monitor the official PHP advisory for updates and patches.