← All reports

Disabling session.upload_progress in PHP is recommended to prevent a potential remote code execution vulnerability (CVE-2026-115560).

CybersecurityTechnologyConflictOct 23, 2026score 1.622 posts · 5 replies across 2 instances
The thread discusses the recommendation to disable the session.upload_progress feature in PHP to mitigate a potential remote code execution (RCE) vulnerability (CVE-2026-115560). It references previous advisories and notes that only specific applications with non-default serialize_handler configurations are at risk. The PHP security team has issued an advisory on their website.

Claims

Disabling session.upload_progress in PHP is recommended to prevent a potential remote code execution vulnerability (CVE-2026-115560).
Parent: Software SecurityEntity: PHP Security AdvisoriesImpact: positiveDate: Oct 23, 2026Target: Disabling session.upload_progress in PHP

Source posts

@[email protected]
Set `session.upload_progress.enabled=0` until the next PHP release to block an unlikely RCE vector (CVE-2026-115560). We already recommended this for CVE-2026-109619 from Wednesday: keep it disabled. Only applications with non-default `serialize_handler` switching it to `php` at runtime can be affected. There is more information in the advisory on the PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1 #php
128 boosts · 71 favs · 5 replies · Oct 23, 2026
#php
@[email protected]
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 on Wednesday, keep it disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. Information advisory on PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1 #php #phpc
47 boosts · 20 favs · 2 replies · Oct 23, 2026
#php#phpc