PHP CVE-2026-115560: Unpatched RCE Risk from Serialization Handler Switching and Upload Progress

1. Basic Information

• Article Name: Informational advisory: Session upload progress
• Publisher: PHP project
• Published Date: 2026-10-23
• Source: PHP project
• Related Sources: BleepingComputer, Sophos, PHP Manual: Session configuration
• Related Malware: Unspecified
• Related Threat Actor: Unspecified
• Related CVE: CVE-2026-115560
• Related Products: PHP, PHP session upload progress
• Severity: High
• Severity Basis: Although the preconditions are rare, it can lead to remote code execution and has no patch at the time of publication. Organizations must check settings and application code, and apply temporary mitigations to block the affected path.

2. Quick Summary

In rare configurations where session.serialize_handler is switched at runtime from php_binary or php_serialize to php, and session_start() is called while session upload progress remains enabled, it can lead to remote code execution. Verify application code paths and authentication controls. No patched version is available yet.

3. Attack Flow

The following technical path is organized based on advance information from the PHP project. It does not apply to all standard PHP environments and requires specific configurations and code patterns to match.

Configuration-Dependent Path Explained by the PHP Project

1. An affected upload request reaches a PHP environment where the initial setting of session.serialize_handler is php_binary or php_serialize, and the session upload progress feature is enabled.
2. Before calling session_start() in the application code, ini_set() must be executed to switch the serialize handler to php at runtime.
3. The PHP project describes the possibility of remote code execution under this specific condition. The full technical advisory is planned for the next regular release. Specific memory-corruption mechanisms and request formats are not established here.
4. The official advance notice does not report successful exploitation in real-world environments or describe follow-on payloads.

4. Attacker Position and Execution Location

• A remote attacker capable of sending HTTP requests to the affected configuration and code path. The official notice does not specify individual entry points, and authentication requirements and access control must be verified per application.

5. Visibility for Victims and Administrators

Victims

• Regular users may not experience any specific indicators.

Administrators and SOCs

• May manifest as PHP worker crashes, HTTP 500 errors, anomalous uploads, or suspicious child processes of the web process.

6. Success and Failure Conditions

Success Conditions

• The initial handler value is php_binary or php_serialize.
• Switch to php using ini_set() before session_start().
• Upload progress is enabled and the request reaches the target.

Failure Conditions and Mitigations

• Set session.upload_progress.enabled=0 in php.ini or applicable server/FPM pool settings that take effect before request parsing, and verify that the setting is applied to targeted persistent workers. Restart persistent workers if they retain old settings. Do not rely solely on ini_set() within the request to disable it.
• Applications that do not change the serialization handler at runtime are not affected by the path described by the PHP project.
• If upload progress has already been disabled to mitigate CVE-2026-109619, keep that setting in place. Confirm the complete advisory and patch level for CVE-2026-115560 after its future release.

7. What Happens Upon Success

• Potential execution of arbitrary code with the privileges of the PHP process.
• Inference: If code execution succeeds, it may impact information and credentials accessible to the PHP process or lead to subsequent compromise. Specific successful lateral movement has not been confirmed.

8. Observable Logs

Inference: The following items are candidates for internal investigation. Availability depends on products, configurations, permissions, and retention periods, and differs from logs observed in sources. A single trace alone does not determine successful compromise.

• Email: None available
• Proxy / SWG / DNS: Suspicious multipart uploads, surge in HTTP 500 errors.
• Endpoint / EDR: php-fpm/httpd/php crashes, core dumps, shells, or downloaders.
• Identity / IdP: None available
• SaaS / Cloud: Container restarts, health check failures.
• Network: Traffic from the web server to unknown destinations.

9. Determining Attack Success

Confirmed in Public Information

The PHP project has announced the possibility of remote code execution and temporary mitigations due to a rare combination of configurations and code. Complete technical details are scheduled for the next regular release, and this notice should not be treated as a report of successful code execution in production environments.

Internal Evaluation Criteria

• Attack Attempt Observed (Success Unconfirmed) (contact_only): Criteria: Confirmed suspicious upload requests targeting the affected configuration. HTTP 500 errors or PHP crashes alone do not confirm remote code execution success.
• Initial Execution Confirmed (initial_execution): Criteria: Backed up by process records or similar evidence showing target requests and corresponding arbitrary code or command execution. Since the complete technical advisory is unpublished, beware of crashes caused by other factors or confusion with other CVEs.
• Follow-on Compromise Confirmed (follow_on_compromise): Criteria: Backed up by unauthorized use of credentials, information access, persistence, or similar activities separate from initial execution.

10. Investigation Playbook

• Trigger: Affected code pattern / PHP worker crash / suspicious upload
• Initial Checks: Verify php.ini, pool settings, and ini_set in source code. / Preserve worker restart times and web logs.
• Endpoint: Check process tree, file modifications, crashes, and persistence.
• Identity / Cloud: Check usage history of credentials, API keys, and service accounts held or used by the target system.
• Follow-On: Check outbound traffic, secret usage, and data access.
• Containment: Disable upload progress and restart workers, restrict public exposure, and rotate secrets if necessary.
• Classification: Distinguish between access/attempts only, initial execution or successful authentication, information access, and follow-on compromise. Do not judge organization compromise based solely on research proofs or public PoCs.

11. Defense and Detection Ideas

• Single Event: Shell execution from a web process / worker crash following an upload
• Time Series: Multipart upload followed by HTTP 500 / crash followed by child process followed by outbound traffic.
• Hunting: Search both configuration repositories and code for handler switching.
• Logging Gaps: Application logs, HTTP 500 errors, and crashes alone cannot identify code execution or root causes. Complete technical details are unpublished, and this must be distinguished from detection signatures specific to this CVE.
• Priority Controls: Disable upload progress / restart workers / apply patched versions

12. Facts / Inference / Hypothesis

Facts

• The PHP project announced CVE-2026-115560 as a rare remote code execution path related to session upload progress.
• Successful exploitation requires the combination of session.serialize_handler being set to php_binary or php_serialize, the application switching to php via ini_set() before session_start(), and upload progress being enabled.
• A complete advisory and patch are scheduled to be provided in the next regular bugfix release. Until then, the PHP project recommends setting session.upload_progress.enabled=0, and notes that no additional action is needed if already applied for CVE-2026-109619.
• Applications that do not change the serialize handler at runtime are not affected by this path.
• The reviewed materials do not report successful exploitation in real-world environments.

Inference

• Not all PHP installations are universally exploitable; both static configurations and ini_set() within application code must be verified.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	medium	Candidate mapping when requests reach public PHP application processes meeting the affected conditions. Authentication controls must be verified individually, and this mapping does not indicate successful active exploitation.

14. Unknowns and Further Investigation

• The complete technical advisory, affected and patched version numbers, specific request formats, access and authentication conditions for each application, and the number of actual victims remain undetermined.

15. Impact on SOCs and Organizations

Organizations running public-facing PHP applications should search their code for combinations of session.serialize_handler, ini_set, and session_start. Disable upload progress and restart workers until the application's affected status has been determined.

16. Key Takeaways by Role

• SOC: Monitor session upload requests, PHP worker crashes, and child processes spawned from web processes.
• Administrators: Apply session.upload_progress.enabled=0, restart all workers, and update after the patched version is released.
• General Users: End users cannot fix this directly. Follow administrator response instructions.