PHP Flags a Third, Less Likely Code Execution Route in a Week; South Korea's KISA Urges an Interim Fix

26 OCT 2026 — PHP has disclosed a third remote code execution flaw in the space of a week, and this one has no patch yet. The PHP project published an informational advisory on 23 October about the language's session upload progress feature, tracked as CVE-2026-115560. A day later, South Korea's Korea Internet & Security Agency (KISA) told users of the affected configuration to switch the feature off until a fix ships.

The new flaw is far narrower than PHP2Shell, the pair of critical bugs PHP patched on 21 October. PHP itself calls it "an unlikely RCE vector" and says it will fix it in the regular release cycle rather than with an emergency release.

What PHP disclosed on 23 October

The advisory is short. PHP suggests administrators "set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector." It promises "a full advisory for CVE-2026-115560 with the next release" but no affected version range and no score.

Session upload progress is a PHP feature that tracks how far an uploaded file has got, and it is on by default. It already appeared in the PHP2Shell response. The GitHub advisory for CVE-2026-109619, one of the two PHP2Shell bugs, names it as one of two confirmed ways to reach stale memory. "Session upload progress can reach session handling before ordinary session initialization," that advisory says.

Three conditions must all hold

PHP calls the risk low because of the configuration needed to trigger it. "The issue can only occur under an unusual combination of configuration and application code," the advisory says.

First, the configuration file has to name php_binary or php_serialize as the session.serialize_handler. Second, application code has to change that handler to php through ini_set(), and do so before session_start() runs. Third, upload progress tracking has to be left on. PHP says software that leaves the serialize handler alone at runtime does not need to disable the feature.

PHP says the setup is "unlikely in practice". It is also the kind of thing an administrator cannot see from the server configuration alone, because the second condition lives in application code.

How KISA framed the warning

KISA's notice of 24 October, posted on its Boho Nara security portal, is headed as a recommendation for interim measures against a new PHP vulnerability. It describes the flaw as a remote code execution bug in PHP's session handling. In our translation from Korean, it says no security update has been released and that users running the affected configuration should apply the interim measure.

The agency's table lists the affected versions as not disclosed by the vendor, and the fixed version as not yet released, expected in the next regular update. It lists PHP's three conditions, says a system is affected only if all of them are met, and says it will update the notice once PHP publishes affected and fixed versions.

The notice links a National Vulnerability Database entry for the CVE. When RECATOOLS queried the NVD's public API on 26 October, it returned no record for CVE-2026-115560.

Not fixed by the 21 October releases

For teams that have just finished patching, one line in KISA's notice matters most. In our translation, it says the flaw is not resolved by the updates released on 21 October, which took the supported branches to 8.2.35, 8.3.36, 8.4.27 and 8.5.12.