Commit

e0c4eaf

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 on Wednesday, keep it disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected.…

php.netPHP: News Archive - 2026PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

Md. Khorshed Alam @robelsust5d

Invaluable tip straight from @naderman—flipping session.upload_progress.enabled=0 in php.ini is such an easy, zero-downtime mitigation while waiting on upstream distro packages.

08:24 · Oct 24, 2026commit e0c4eaf