Published 26 October 2026
PHP’s October 23, 2026 advisory describes a further remote-code-execution risk, CVE-2026-115560, that is limited to an unusual combination of PHP session settings and application code. The PHP team recommends setting session.upload_progress.enabled=0 until a regular bug-fix release addresses the issue. If you manage your own server, apply the setting in server-level PHP configuration and restart the relevant PHP workers; if you use shared hosting, ask your provider whether it has been applied.
This advisory is separate from the two critical PHP flaws patched on October 21. Updating to those fixed releases remains essential, but it does not by itself resolve CVE-2026-115560. WordPress users do not need a WordPress core update for these PHP runtime issues: the PHP runtime is managed at the hosting or server level. ([php.net](https://www.php.net/archive/2026.php))
What is CVE-2026-115560?
PHP’s advisory says the issue can arise only when an application uses a specific sequence: it configures session.serialize_handler as php_binary or php_serialize, changes it to php at runtime with ini_set() before calling session_start(), and leaves session upload progress enabled. The PHP team says this is an unusual configuration and plans to provide a full advisory with a regular release. The interim recommendation is to disable session upload progress. ([php.net](https://www.php.net/archive/2026.php))
In practical terms, most site owners should not try to infer exposure from their CMS alone. A WordPress, Laravel or ecommerce site may run PHP, but whether this particular configuration exists depends on its application code and server settings. If you do not maintain that code or server, your hosting provider or developer is the right person to verify it.
Why the October 21 PHP update is still necessary
On October 21, PHP issued fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618 and CVE-2026-109619. PHP said those vulnerabilities affected PHP installations serving web requests and that updating was the only complete fix. The October 23 advisory says those releases do not fix CVE-2026-115560; keeping the upload-progress setting disabled is the interim protection for that separate issue. ([php.net](https://www.php.net/archive/2026.php))
Do not treat a web application firewall, a security plugin, or a successful WordPress update as a substitute for updating PHP. These controls operate at different layers. A PHP runtime flaw needs a PHP package update or a vendor-supported backport; the October 23 configuration recommendation is an additional measure pending the regular fix. ([wordpress.org](https://wordpress.org/news/2026/10/critical-php-security-release/))
What website owners should do now
- Identify the PHP runtime actually serving the site. In WordPress, check Tools > Site Health > Info > Server. A cPanel account may also show domain PHP settings in MultiPHP Manager, if the hosting provider enables that interface. Record the domain and displayed PHP version before contacting support. ([wordpress.org](https://wordpress.org/news/2026/10/critical-php-security-release/))
- Ask the host to confirm both protections. Request confirmation that the installed PHP package includes the October 21 fixes for CVE-2026-109618 and CVE-2026-109619, and that
session.upload_progress.enabled=0is applied at an appropriate server-level setting until the regular fix for CVE-2026-115560 arrives. - If you administer the server, check every PHP stack. A server can have multiple PHP versions, handlers or account-level selections. Confirm the affected website’s handler and ensure the setting reaches the PHP process that handles requests. PHP advises applying it through configuration that takes effect before request parsing, such as
php.inior an FPM pool, and restarting all relevant workers. Avoid relying on application-levelini_set()or a per-directory setting for this mitigation. ([php.net](https://www.php.net/archive/2026.php)) - Test the site’s upload and session workflows. Disabling upload progress can affect features that display progress during file uploads. Test customer-facing forms, product-image uploads, document submission and any import workflow in a staging environment where possible. If an upload feature breaks, ask the developer and hosting administrator to review the implementation rather than simply re-enabling the setting.
- Keep normal patch and incident checks moving. Verify the version or vendor backport, restart the relevant service, then test the live site. If you have server access and reason to suspect prior abuse, preserve logs and investigate unusual requests, unexpected file changes and processes. Do not rely on a single IP list as proof of compromise or safety.
Shared hosting, cPanel and backported packages
On shared hosting, customers typically cannot replace the PHP binary or change server-wide settings themselves. Send support the CVE identifier and ask for a clear status: package fixed, configuration mitigation applied, or action pending. If the provider says it uses a backported package, the visible PHP version number may not match the upstream fixed release number. Ask how the vendor confirms the patch rather than concluding that a lower-looking version is automatically vulnerable.
On cPanel systems, domain PHP selection and server package management are separate tasks. MultiPHP Manager lets an account select among PHP versions installed and made available by its administrator; it does not itself install the security fix. Server administrators should use their supported package and control-panel update process, then restart PHP services as required by that environment. ([docs.cpanel.net](https://docs.cpanel.net/cpanel/software/multiphp-manager-for-cpanel/))
Important: Disabling session upload progress is an interim mitigation for CVE-2026-115560, not a replacement for the PHP security updates addressing the October 21 vulnerabilities. Confirm both items separately with the team responsible for your server.
HostCupid perspective
For a business website, the useful question is not simply “Which PHP version does my dashboard show?” It is “Which runtime serves this domain, has that runtime received the relevant vendor fixes, and does the recommended configuration reach its PHP workers?” HostCupid is a Chennai-based provider of shared and WordPress hosting, reseller hosting, website development and migration assistance. Customers using a hosting service should contact their provider for server-level confirmation; developers maintaining custom PHP applications should review session configuration and test upload-dependent features before changing production settings.
Keep a brief record of the affected domain, PHP handler, provider response, change made and post-change test. That gives your developer or hosting support team a concrete starting point when the next PHP fix is released.
Sources
- PHP: Informational advisory: Session upload progress and critical remote code execution vulnerabilities · 2026-10-23
- PHP shares mitigation for new RCE vulnerability with no patch · 2026-10-23
- Critical PHP Security Release · 2026-10-21
- MultiPHP Manager for cPanel
- PHP CVE-2026-109618 and CVE-2026-109619: CloudLinux Package Status and Imunify360 Protection · 2026-10-21
