1. Basic Information

Article Name : Informational advisory: Session upload progress

Publisher : PHP project

Published Date : 2026-10-23

Source : PHP project

Related Sources : BleepingComputer , Sophos , PHP Manual: Session configuration

Related Malware : Unspecified

Related Threat Actor : Unspecified

Related CVE : CVE-2026-115560

Related Products : PHP, PHP session upload progress

Severity : High

Severity Basis : Although the preconditions are rare, it can lead to remote code execution and has no patch at the time of publication. Organizations must check settings and application code, and apply temporary mitigations to block the affected path.

2. Quick Summary

In rare configurations where session.serialize_handler is switched at runtime from php_binary or php_serialize to php , and session_start() is called while session upload progress remains enabled, it can lead to remote code execution. Verify application code paths and authentication controls. No patched version is available yet.

3.…