A new PHP warning, but a much narrower one

On 23 October, PHP recommended temporarily setting session.upload_progress.enabled=0 while it prepares a regular bugfix release for CVE-2026-115560. PHP calls this an unlikely remote-code-execution vector. Its notice does not say the new issue is being exploited, and it does not undo the value of the 21 October fixes for CVE-2026-109618 and CVE-2026-109619.

The new path needs several conditions together: the application starts with session.serialize_handler configured as php_binary or php_serialize, changes it to php at runtime using ini_set() before session_start(), and leaves session upload progress enabled. PHP says applications that never make that runtime handler change can keep upload progress enabled without this specific exposure.

1. 1

   Keep the emergency fixes. Confirm every web-serving PHP worker runs a release or vendor backport that addresses the two 21 October CVEs. This new notice does not make that patching optional.

2. 2

   Review session behavior. Check the effective handler setting and search application or framework initialization for a runtime switch to php before session_start(). A version string alone cannot answer this question.

3. 3

   Decide on the temporary control. If you cannot rule out the described path, consider PHP's recommended session.upload_progress.enabled=0 setting and restart workers. Test any upload-progress feature that depends on it, then track the forthcoming fixed release.

A scanner result for PHP2Shell, a vulnerable version, and this session configuration are different findings. Record which one you actually established. In particular, the exploitation attempts reported for the earlier PHP flaws should not be presented as evidence that CVE-2026-115560 is being used in attacks.