PHP Flags a Narrow Remote Code Execution Risk in Session Settings

PHP flagged a separate, unlikely remote-code-execution (RCE) path on Oct. 23, tied to an uncommon session configuration, following patches for two critical web-facing flaws released two days earlier.

Identified as CVE-2026-115560, the new path involves an application setting session.serialize_handler to php_binary or php_serialize, changing it to php with ini_set() before session_start(), and leaving session upload progress enabled.

PHP recommended setting session.upload_progress.enabled=0 until its next regular bug-fix release. The notice describes a narrow configuration condition and does not state that every PHP site is vulnerable to this path.

The advisory follows the Oct. 21 release of fixes for CVE-2026-109618 and CVE-2026-109619. The patches were released at 10 a.m. ET (14:00 UTC) in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP rated both flaws 9.2 out of 10 under CVSS v4.0. The Oct. 21 patch release addressed those vulnerabilities.

PHP said all installations serving web requests were at risk from the earlier flaws and identified mod_php as the highest-risk setup. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed were among the affected web-facing setups. The new notice describes a separate path tied to the specified session settings.

PHP versions 8.1 and older no longer receive updates from the project. Some Linux distributions and long-term support vendors may provide backported fixes.

PHP was used by 69.3% of websites with a known server-side programming language in an Oct. 23 measurement. That figure measures language use; it does not count sites using the settings in the new notice or confirm whether sites installed the Oct. 21 patches.