Skip to contentistheinternetok
All incidents

Security flaw·Minor

PHP: lower-risk session upload progress flaw

IdentifiedAffects website owners
PHP

What it changes for you

Nothing visible for you; a few site owners must change a setting.

PHP disclosed one more flaw, affecting only sites with an unusual session setup. No fix yet, but a simple setting turns it off; visitors have nothing to do.

Started Oct 23, 2026Updated Oct 23, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Set session.upload_progress.enabled=0 until the next PHP bugfix release. Only apps that switch session.serialize_handler from php_binary or php_serialize to php at runtime are affected. If you already applied this setting for PHP2Shell, nothing more to do.

What is affected

CVE-2026-115560

Timeline

  1. Identified · Oct 23, 2026

    Cloudflare says the issue affects fully patched releases including 8.5.12 and adds WAF coverage.

    Cloudflare

  2. Identified · Oct 23, 2026

    PHP publishes an informational advisory for CVE-2026-115560; the fix comes in the next regular bugfix release.

    php.net

Sources

Related