PHP CVE-2026-115560: a third remote code execution flaw needs mitigation now

A third PHP remote code execution vulnerability, CVE-2026-115560, was disclosed on 23 October 2026. The emergency releases published two days earlier fix two other critical flaws, but not this one. Teams running PHP need to do two things today: install those releases, and apply a temporary configuration change until PHP ships a fix.

What the emergency releases fixed

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution: an attacker who can reach an affected application may be able to run their own code on the server without logging in. Apply them immediately. For the technical details, the official sources are the PHP 8 changelog and the CVE records for CVE-2026-109618 and CVE-2026-109619.

The new flaw: CVE-2026-115560

CVE-2026-115560 is a separate potential remote code execution path involving session serialization and session upload progress. No fixed PHP release was available as of 23 October 2026: the PHP project plans to publish a full advisory and a fix with its next regular release, rather than an out-of-band update.

Exploitation requires all of these unusual conditions:

• session.serialize_handler is configured as php_binary or php_serialize;
• application code changes the handler to php with ini_set() before calling session_start();
• session.upload_progress.enabled is still enabled.

Applications that never switch the session serialization handler at runtime are not exposed through this path. If you cannot confidently rule those conditions out, apply the mitigation below. See the PHP security team's notice and the Canadian Centre for Cyber Security alert.

Which version you need

• PHP 8.5: 8.5.12 or later.
• PHP 8.4: 8.4.27 or later.
• PHP 8.3: 8.3.36 or later.
• PHP 8.2: 8.2.35 or later.

These versions address CVE-2026-109618 and CVE-2026-109619 only; they are not fixed versions for CVE-2026-115560. PHP 8.1 and older branches no longer receive security fixes, so moving off them is urgent, not a later project.

Find every PHP you run

The hard part is usually the inventory, not the update. PHP hides in web servers running PHP-FPM or an Apache module, in Docker images (including those only built in CI), in scheduled jobs and workers using the PHP command line, and on shared or managed hosting. On a server, check both the command line and the PHP the web server actually uses, which can differ:

php -v
php-fpm8.4 -v          # the FPM binary name follows your version
php -r 'echo PHP_VERSION, PHP_EOL;'

How to update

Debian and Ubuntu: install the security updates, then restart PHP and the web server.

sudo apt update
sudo apt upgrade
sudo systemctl restart php8.4-fpm   # or apache2, nginx and your PHP-FPM version

Red Hat, Rocky, Alma and Fedora: the same with dnf.

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

Docker: rebuild every image on the latest base image and redeploy it everywhere, not just in production. --pull fetches the new base image instead of reusing a cached one.

docker build --pull -t my-app .

Managed hosting: check your provider's status page or ask support which PHP release you run and when the fix is applied.

Mitigate CVE-2026-115560 now

Until PHP publishes a fixed release, disable session upload progress in the effective configuration of each affected runtime. It is a temporary mitigation, not a substitute for the two patches above.

; php.ini or the relevant PHP-FPM pool configuration
session.upload_progress.enabled = 0

Restart all PHP workers (a configuration reload is not enough), then check the setting in the PHP that serves the website: the command line and PHP-FPM can load different configuration files.

php -i | grep 'session.upload_progress.enabled'
# Check the web-serving PHP-FPM pool configuration too, then restart it:
sudo systemctl restart php8.4-fpm

For Docker images based on the official PHP images, bake the setting into the image and redeploy every replica:

RUN printf '%s\n' 'session.upload_progress.enabled=0' \
    > /usr/local/etc/php/conf.d/99-session-security.ini

Disabling it can affect upload progress bars that rely on PHP sessions, but ordinary file uploads keep working. If you already applied this setting for CVE-2026-109619, keep it in place.

Check the result

• Run php -v again, and check the FPM binary too: a pool that was not restarted keeps running the old code.
• Confirm session.upload_progress.enabled=0 in the web runtime where the mitigation is needed, and review any runtime change to session.serialize_handler.
• Restart PHP-FPM and the web server, then test the application.
• Debian, Ubuntu and Red Hat style distributions often backport security fixes without changing the PHP version number, so php -v may still show an older version: check your distribution's advisory for the package that fixes these CVEs.

The bottom line

Three PHP CVEs now need attention. Patch CVE-2026-109618 and CVE-2026-109619 with the October emergency releases, disable session upload progress until the next release fixes CVE-2026-115560 if you cannot rule out the vulnerable pattern, verify every runtime, and watch for PHP's next advisory. As the OpenGate VPN case showed, attackers move within days of disclosure.