PHP advises disabling session upload progress following new unpatched flaw

The PHP security team issued an advisory on October 23, 2026, warning of a new unpatched remote code execution risk identified as CVE-2026-115560. The Hacker News and BleepingComputer both report that the vulnerability affects web applications configured in non-default or unusual session setups. PHP does not consider the flaw an emergency risk and is recommending a temporary mitigation instead of an immediate patch, according to both outlets. [1][2][3]

The Hacker News reported that the issue stems from a feature called session upload progress. To prevent potential exploitation, the project recommends turning off session upload progress until a official patch is provided in the next routine software release, according to The Hacker News and BleepingComputer. [1][2][3]

The warning follows an emergency patch release on October 21 for two critical vulnerabilities dubbed PHP2Shell, as FTMQ Security reported earlier. Those critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and affect PHP versions 5.4 through 8.5, as FTMQ Security reported earlier. [1][12][14][15]

PHP is a general-purpose scripting language used by nearly 70% of all websites on the Internet, according to BleepingComputer. VirusTotal estimates show that more than 5.1 million PHP hosts are exposed online, with approximately 3.8 million having at least one open port, BleepingComputer reported. [2][12][13]