PHP vulnerability, October 2026: is CVE-2026-115560 a risk?

What is the PHP session vulnerability CVE-2026-115560, and why is there another one?

It's a weakness in how PHP handles session data. With a rare combination of settings and application code, an outside request could get the server to run code. The PHP team announced it on October 23, 2026 as an "informational advisory" and called it "an unlikely RCE vector".¹

The affected versions haven't been listed yet, and the fix is planned for the next regular release.¹ The October 21 PHP2Shell updates (8.5.12, 8.4.27, 8.3.36 and 8.2.35) don't cover it. Cloudflare put it plainly: "It affects fully patched PHP releases, including 8.5.12".² As of October 26, php.net still lists those October 21 releases as the newest.³

When warnings arrive two or three times in a week, people stop reacting. Health care has a name for it: alert fatigue, when people "become desensitized to safety alerts" and start ignoring them.⁴ So this time, I'll keep what you have to do as small as it can be.

1. What: a remote code execution flaw in PHP session handling (CVE-2026-115560)
2. When it's a risk: only when all three conditions are true
3. How to close it: set session.upload_progress.enabled=0, then restart PHP
4. Maybe done already: if you set it for PHP2Shell, there's nothing more to do

Four points on one card. Each one is explained below.

Three locks.

Jeensuk's takeThis one is less "patch it tonight" and more "check whether one setting is on."

What are the three conditions that make a site vulnerable?

A site is affected only when all three are true. The PHP team also says that "Applications that never change the serialize handler at runtime can keep the feature enabled."¹

Upload progress tracking (condition 3) is what powers progress bars that show how much of a large file has been uploaded.⁵ The PHP manual says it "Defaults to 1, enabled", so it's true on most servers.⁵ That's why the fix is to turn condition 3 off.

Jeensuk's takeConditions 1 and 2 only exist if someone changed them on purpose. Your job is to lock number 3.

How do I check whether my site is affected?

Look at two server settings and one thing in the site's code. On a VPS or droplet, read the values the web server actually uses (a phpinfo() page served through the site, or the PHP-FPM pool config). Running php -i on the command line reads the CLI configuration, which can be a different file.

1. Setting for condition 1: what session.serialize_handler is set to (the default is php).
2. Setting for condition 3: whether session.upload_progress.enabled is 0 (off) or 1 (on).
3. Code for condition 2: search the site's files and config for code that changes "serialize_handler" at runtime. Astra Security recommends the same search.⁶ If nothing turns up, condition 2 doesn't apply.

If a host, agency or managed WordPress provider runs PHP for you, you can send them this as-is:

On WordPress, Tools → Site Health gives one more clue. If a PHP session is open, WordPress flags it as critical: "An active PHP session was detected". The reason it gives is "This interferes with REST API and loopback requests."⁷ But that test only looks at the request Site Health makes from the admin screen. No warning means no session was open at that moment, not that no plugin ever opens one on a public page.

Jeensuk's takeAsking isn't rude. If the answer is "already done," you're finished with this one.

What is the one setting that closes it?

Set session.upload_progress.enabled to 0, then restart PHP. The PHP team's October 21 advisory and Hostinger's notice describe the same step: turn it off in php.ini or your PHP-FPM pool config, then restart all PHP workers.^8·9

The "Don't" column comes from the PHP team's October 21 advisory on PHP2Shell (CVE-2026-109619): "Do not rely on ini_set() or FPM .user.ini."⁸ The manual lists this setting as changeable only per directory or in php.ini, so ini_set() can't change it anyway.⁵ If you made this change for PHP2Shell, leave it as it is. There's nothing more to do.¹

If you applied it then, keep it in place and no further action is needed. — The PHP team, informational advisory, October 23, 2026

Know what turning it off changes. If your site built a file upload progress bar on this feature, that bar may stop moving.⁵ The manual itself suggests turning it off where you don't use upload progress bars.⁵ Company websites rarely use one, but if your contact form takes attachments, upload a test file after the change.

Jeensuk's takeOne line of config, one test upload. That's the whole job.

What if my site is on a VPS, a hosting plan or WordPress?

On a VPS or droplet, it's on you. DigitalOcean's shared responsibility model says "you secure the operating system (OS) you install on your droplet", and that includes PHP and its configuration.¹⁰ If you're not sure who looks after your server, read our article on PHP sites on a VPS or your own server first.

A few providers have said what they did. Hostinger says "Every Hostinger hosting plan except VPS is already fully protected"; VPS customers make the change themselves.⁹ xCloud says the setting was "applied to all xCloud servers, Managed and Self-Managed, on 21 October 2026".¹¹ Cloudflare's firewall rules block known attempts, but only while the upload progress field keeps its default name.² As of October 26 we couldn't find a notice about this CVE from DigitalOcean, Bluehost, SiteGround, WP Engine or Kinsta. That doesn't mean they did nothing. It means you should ask, using the message in section 03.

WordPress itself treats an open session as a problem.⁷ Whether a plugin or custom code uses sessions depends on the site, though. So rather than assuming "it's WordPress, so we're fine," turn off condition 3.

Jeensuk's takeDon't fill the gaps with "probably fine." One line of config makes you safe even when you don't know.

What should I do when the fix ships, and how do I keep up with the warnings?

When the fixed release ships, upgrade PHP to it. The PHP team says it will publish a full advisory with the next release.¹ On a distro package, check the package changelog, not just the version number: Ubuntu, for example, shipped its PHP2Shell fix as package 8.3.6-0ubuntu0.24.04.13 rather than as PHP 8.3.36.¹²

Why hasn't this shown up in your CISA feed? CISA's October 21 alert (revised October 23) covers only the two PHP2Shell CVEs, and CVE-2026-115560 isn't in its Known Exploited Vulnerabilities catalog.^13·14 No exploitation in the wild had been reported as of October 26. Several GitHub repositories claiming lab proofs of concept did appear from October 23, and Brandefense notes it has not verified them.¹⁵ Don't download or run code like that on your server to test it.

And PHP news won't stop here. Security support for PHP 8.2 ends on December 31, 2026, and after that even fixes like this one stop coming.³ What to do for each version is in our article "PHP 8.2 support ends Dec 31: what to decide now".

Jeensuk's takeThe warnings will keep coming. The best way not to be caught off guard is to decide now who does what.