Recommendation for a Temporary Workaround for a PHP Product Vulnerability (CVE-2026-115560)

Overview

---

The PHP development team has announced a temporary workaround for CVE-2026-115560, a remote code execution vulnerability that occurs during the processing of session.Upload_progress. A security update addressing this vulnerability has not yet been released.

Affected Environments

---

PHP environments that meet all of the following conditions are affected:

• When the session.Serializehandler setting is set to phpbinary or php_serialize.
• When the session.Serializehandler value is changed to php through iniset() before calling session_start().
• When the session.Upload_progress.Enabled setting is enabled.

Vulnerability Details

---

This vulnerability is a remote code execution vulnerability that occurs during the processing of PHP session upload progress. In other words, a threat actor could exploit a vulnerable environment to attempt to execute arbitrary code.

Temporary Mitigation

---

Until a security update is released, you must disable this feature by setting session.Upload_progress.Enabled=0 in php.Ini or the PHP-FPM pool configuration. After changing the setting, you must restart all PHP workers or related web server services.

References

---

The official PHP security advisory, the temporary mitigation recommendation from KISA’s “Bohwonara,” and the NVD entry for CVE-2026-115560 are provided as reference materials.