How to Mitigate the New PHP RCE Vulnerability CVE - 2026 - 115560

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• The critical CVE - 2026 - 115560 RCE can be stopped by setting session.upload_progress.enabled = 0.
• Only applications that alter session.serialize_handler at runtime are vulnerable.
• Apply the fix immediately; a full PHP patch is pending.
• Review other recent PHP RCE bugs (CVE - 2026 - 109618, CVE - 2026 - 109619) and keep your runtime up to date.

What is CVE - 2026 - 115560 and why does it matter?

CVE - 2026 - 115560 is a remote - code - execution flaw in PHP that can be exploited when an application changes the session.serialize_handler setting at runtime while leaving session.upload_progress.enabled turned on. The combination lets an attacker inject malicious code via the session upload - progress mechanism, leading to full server compromise.

Which PHP setups are vulnerable?

The vulnerability only affects installations that:

1. Modify session.serialize_handler from its default (php) to either php_binary or php_serialize during execution, and
2. Keep session.upload_progress.enabled set to 1 (the default). If either condition is false, the exploit vector does not exist.

Immediate mitigation steps

1. Open your php.ini (or the relevant per - directory ini file).
2. Add or update the line:

session.upload_progress.enabled = 0

1. Restart the PHP - FPM or Apache process to apply the change.
2. Verify the setting with php -i | grep session.upload_progress.enabled - it should report 0.

These three lines block the attack surface while the PHP development team prepares an official patch.

Longer - term remediation

• Avoid runtime changes to session.serialize_handler. Keep the default serializer (php) unless you have a compelling reason and you understand the security impact.
• Monitor PHP release notes. Apply official patches as soon as they are released.
• Audit your codebase. Search for ini_set('session.serialize_handler', ...) or similar calls and evaluate whether they are necessary.
• Run a security scan. Tools like Decloak’s free web scan can highlight insecure PHP configurations, including exposed session settings, as part of its JavaScript CVE scanning and vibe - coded platform security layers.

Related recent PHP RCE bugs

Two other unauthenticated RCE issues, CVE - 2026 - 109618 and CVE - 2026 - 109619 (collectively known as “PHP2Shell”), were patched quickly after disclosure. They illustrate how rapidly PHP can be targeted and why a proactive scanning and patching strategy is essential.

How to verify the fix

After disabling the upload - progress feature, test a request that would normally trigger the upload - progress handler (e.g., a multipart file upload). The server should respond without creating the $_SESSION['upload_progress'] entry. Absence of that entry confirms the mitigation is active.

When a patch arrives

Once the PHP team releases an updated binary, you can revert the temporary mitigation if you still need the upload - progress feature. Replace the 0 with 1 and retest your application to ensure normal functionality.

Conclusion

Disabling session.upload_progress.enabled is a simple, proven way to block CVE - 2026 - 115560 today. Combine this with a policy of not altering the session serializer at runtime and regular scanning to keep your PHP applications safe.

Further reading

• Official PHP security advisory (BleepingComputer) for CVE - 2026 - 115560.
• Decloak’s guide on scheduled scans and alerts to stay ahead of emerging web vulnerabilities: /journal/set-it-once-scheduled-scans-email-alerts-slack-and-webhooks-in-decloak