pwned.coffeeUpdated 39 min ago

Today's specials

pwned.coffeeOrder ticket · today's special · 21 Oct 2026

House blend · ?unknown86'd · no fix yet

PHP: session upload progress RCE in an unusual configuration

PHP

PHP issues emergency security alert for two critical RCE flaws

Do this now

Check whether session upload progress is enabled in your PHP setup and disable it until fixed.

First seen
Last update
Identifiers
Source
news
On the menu as

Timeline

  1. PHP Session upload progress vulnerability CVE-2026-115560

  2. Widespread PHP flaw may cause many site outages

  3. PHP issues emergency patches for two critical RCE flaws

  4. Workaround for PHP RCE flaws not enough

  5. First reported.

Receipt

Exploitation
No known exploitation
  • Checked by hand “php.net: a separate, unlikely RCE vector (needs the session serialize handler switched at runtime). Fixed in the next regular bugfix release, not in the PHP2Shell releases; no CVSS published yet.” source
Fix
Set session.upload_progress.enabled=0 until the next regular PHP release.
Score
Severity unknown, checked by hand: php.net: a separate, unlikely RCE vector (needs the session serialize handler switched at runtime). Fixed in the next regular bugfix release, not in the PHP2Shell releases; no CVSS published yet.
Last checked

Sources: KEV – CVE record – Vendor ✓

Sources

Totalone coffee