A new PHP CVE was announced. Here's what you need to know

Two days after PHP's big security release, the PHP security team posted another notice. This one is new and is being tracked as CVE-2026-115560, a remote code execution bug in session upload progress. There's no patched PHP release for it yet.

The good news is it takes a really specific setup to exploit. The confusing part is how it relates to Wednesday's release. Let's clear it up.

How this relates to Wednesday's CVEs

On October 21, PHP fixed CVE-2026-109618 and CVE-2026-109619. I covered both in this post. Updating to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 fixed those two.

It does not fix CVE-2026-115560 (today's vulnerability). This is a separate vulnerability.

The overlap is the workaround. The advisory for CVE-2026-109619 already suggested turning off session.upload_progress.enabled if you couldn't update right away. The real fix was patching, so most people just patched.

Now PHP is recommending session.upload_progress.enabled=0 again, this time to block CVE-2026-115560.

Are you affected?

Your app is only exposed if all three of these are true:

1. session.serialize_handler is set to php_binary or php_serialize in your PHP config
2. Your code switches it to php with ini_set() before calling session_start()
3. Session upload progress is enabled (it's on by default)

The first two are the rare part. Most apps never touch the serialize handler, let alone change it in the middle of a request. PHP acknowledges this, which is why they're shipping the fix in their regular release cycle instead of an emergency release.

Search your codebase for anything that changes it:

grep -rn "serialize_handler" --include="*.php" .

Leave vendor/ in the search, because a package could be the one doing it.

Then check what your config is set to:

php -i | grep -E "session.serialize_handler|session.upload_progress.enabled"

If you run Laravel

Laravel doesn't use PHP's built-in sessions. When Laravel starts a session, it reads the raw data from its own driver (file, database, Redis, etc.) and decodes it with unserialize() or json_decode(). The framework never calls session_start() and never touches session.serialize_handler, so it can't meet the second condition.

You'd only be exposed if your own code or a package starts a native PHP session alongside Laravel. That's what the grep above is for.

Turn off session upload progress

Until PHP ships a patched release, set this in your php.ini or FPM pool config:

session.upload_progress.enabled = 0

Then restart PHP so every worker picks it up. PHP's advice from Wednesday still applies here: don't rely on ini_set() or .user.ini, because the setting needs to apply before PHP parses the request.

The only thing you lose is upload progress tracking through $_SESSION. Most upload progress bars these days come from JavaScript in the browser, not from this.

If you use serversideup/php

We released v5.0.3 this morning to be safe. It adds a PHP_SESSION_UPLOAD_PROGRESS_ENABLED environment variable and defaults it to 0.

Our images already default session.serialize_handler to php, so most people running them were never in a position to hit this. We'd still rather ship the safe default than have everyone audit their apps by hand.

PHP versions didn't change from v5.0.2, so here's how to update based on your tag:

docker compose pull
docker compose up -d

Then confirm it's off:

docker compose exec php php -i | grep session.upload_progress.enabled

You should see session.upload_progress.enabled => Off => Off.

If your app needs upload progress and never changes the serialize handler at runtime, you can turn it back on:

services:
  php:
    image: serversideup/php:8.4-fpm-nginx
    environment:
      PHP_SESSION_UPLOAD_PROGRESS_ENABLED: "1"

We'll revisit the default once PHP ships its fix.

FrankenPHP 1.13.2

v5.0.3 also moves our FrankenPHP images to FrankenPHP 1.13.2. It fixes three advisories in FrankenPHP itself. The one I'd care about most: an unauthenticated client could tie up every PHP thread by queuing requests and disconnecting.

docker compose exec php frankenphp version

Happy Friday

It's been a week, but don't panic too much.

CVE-2026-115560 needs a rare setup to exploit, and one setting blocks it. Turn off session upload progress, or pull v5.0.3 if you use our images. Then update PHP again when the next regular release ships.

Have questions? Jump into our Discord and let us know.