PHP disclosed CVE-2026-115560, a remote code execution (RCE) flaw, on Oct. 23, but says it requires an unusual combination of application code and settings. The maintainers recommend disabling session upload-progress tracking until a regular bug-fix release; they say most deployments are unlikely to meet the conditions.
An application must choose a nondefault session format—php_binary or php_serialize—then switch back to PHP’s usual php format at runtime before starting a session. If upload-progress tracking is still enabled, that sequence creates the RCE condition. Applications that never switch formats at runtime do not meet the described condition.
The interim exposure therefore sits with applications that make this runtime switch, not every PHP site that leaves upload progress enabled. PHP says a future regular bug-fix release will address the flaw.