1-minute read
What a defender needs to know
PHP’s October 23 advisory recommends session.upload_progress.enabled=0 until the next regular bugfix release, even after the emergency patches for CVE-2026-109618 and CVE-2026-109619. The new, unlikely code-execution path needs an application that switches session.serialize_handler from php_binary or php_serialize to php with ini_set() before session_start() while upload progress remains on. PHP plans to publish a full CVE-2026-115560 advisory with the next release. Applications that never change the serializer at runtime can keep the feature enabled.
The two patched flaws let crafted unauthenticated HTTP requests potentially reach code execution in PHP workers. One involves out-of-memory cleanup of partly initialized request data; the other involves a stale reference carried into a later request on the same worker. Check the build serving each site against 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or verify a distribution backport with its vendor. Earlier branches need an applicable backport or an upgrade.
Where PHP’s precaution applies, set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration before request parsing, recycle every worker, and read the effective setting from the web-serving context. ini_set() and FPM .user.ini act too late for this control. Inspect unusual PHP worker exits and memory-allocation behavior while correlating suspect web requests; a fixed build addresses the original pair, and the setting addresses the later session path.