# PHP Flags New Remote Code Execution Path and Urges Users to Disable Upload Progress

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/39344
Published: 2026-10-23T21:28:04.000Z
Updated: 2026-10-23T21:28:04.000Z
Section: Technology

> CVE-2026-115560 requires an unusual session setup. Users who already disabled upload progress for an earlier PHP flaw need no additional change.

PHP maintainers disclosed a separate, unlikely remote code execution path Friday, urging operators to disable session upload progress until the next regular bug-fix release to reduce exposure.

The issue, CVE-2026-115560, involves an unusual setup: an application uses php_binary or php_serialize for session serialization, switches to php at runtime before starting a session, and leaves upload progress enabled. PHP advised setting session.upload_progress.enabled=0 until the next regular bug-fix release.

Operators who already disabled upload progress to mitigate CVE-2026-109619 do not need another change for this issue. PHP has not listed an affected-version range or a fix date and plans to expand the advisory with its next regular release.

The notice follows Oct. 21 fixes for two earlier PHP2Shell flaws that could allow unauthenticated code execution on PHP installations serving web requests. Separately, the Netherlands’ National Cyber Security Centre cited one possible exploitation report abroad involving those earlier flaws, but said a successful attack had not been confirmed. The agency assessed mass exploitation as less likely than previously estimated.