session.serialize_handler
A PHP setting that decides how session data is stored; the default is php. CVE-2026-115560 only matters when this is set to php_binary or php_serialize and a program switches it back to php while running.
session.serialize_handler is a PHP setting that decides what format PHP uses when it writes session data, meaning the things it briefly remembers about a visitor, into a file or other storage. It is like deciding whether to write the same notes in a notebook as a table or as plain sentences. The default is php, and most sites never change it.
Watch out CVE-2026-115560 only matters in the rare case where this is set to php_binary or php_serialize and a program then switches it back to php while running. If you never changed the setting yourself, it is most likely still the default, but if you want to be sure, ask your hosting company or whoever manages the site what this value is.
Source: PHP informational advisory (2026-10-23), KISA KrCERT (2026-10-24)