Nils Adermann: “Set session.upload_progress.enabled=0 till next PHP release…”

Nils Adermann @naderman4d

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 on Wednesday, keep it disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. Information advisory on PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1

php.netPHP: News Archive - 2026PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

11:04 · Oct 23, 2026commit 4473ff6

Brent Roose @brendtquoted4d

Small PHP security followup, worth checking out

Jasper Helmich @ao-jhelmich4d

Makes you feel alive eh

Scott @ssxquoted4d

PSA: Not the same CVE as the two fixed this week, additional issue.

Commit