# PHP Flags a Narrow Remote Code Execution Risk in Session Settings By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/39117 Published: 2026-10-23T16:10:10.000Z Updated: 2026-10-23T16:10:10.000Z Section: Technology > The Oct. 23 notice identifies CVE-2026-115560 and recommends disabling session upload progress until PHP’s next regular bug-fix release. PHP flagged a separate, unlikely remote-code-execution (RCE) path on Oct. 23, tied to an uncommon session configuration, following patches for two critical web-facing flaws released two days earlier. Identified as CVE-2026-115560, the new path involves an application setting session.serialize_handler to php_binary or php_serialize, changing it to php with ini_set() before session_start(), and leaving session upload progress enabled. PHP recommended setting session.upload_progress.enabled=0 until its next regular bug-fix release. The notice describes a narrow configuration condition and does not state that every PHP site is vulnerable to this path. The advisory follows the Oct. 21 release of fixes for CVE-2026-109618 and CVE-2026-109619. The patches were released at 10 a.m. ET (14:00 UTC) in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP rated both flaws 9.2 out of 10 under CVSS v4.0. [The Oct. 21 patch release]() addressed those vulnerabilities. PHP said all installations serving web requests were at risk from the earlier flaws and identified mod_php as the highest-risk setup. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed were among the affected web-facing setups. The new notice describes a separate path tied to the specified session settings. PHP versions 8.1 and older no longer receive updates from the project. Some Linux distributions and long-term support vendors may provide backported fixes. PHP was used by 69.3% of websites with a known server-side programming language in an Oct. 23 measurement. That figure measures language use; it does not count sites using the settings in the new notice or confirm whether sites installed the Oct. 21 patches. ## Links in this article - [The Oct. 21 patch release](https://www.tokenpost.com/news/technology/37442)