The developers of the PHP project warned about the identification of another vulnerability (CVE-2026-115560), which could potentially be used for remote code execution on the server with a certain rare combination of non-standard settings (not in the default configuration) and executed PHP code. We intend to publish details about the vulnerability after the next corrective releases of PHP are ready.
As a workaround for protection, it is recommended to set the parameter “session.upload_progress.enabled=0” in php.ini, which was also recommended as one of the measures to block the previous critical vulnerability. The problem manifests itself when the “session.serialize_handler” parameter is set to the value “php_binary” or “php_serialize” in the settings, and this parameter is changed in the PHP code to the value “php” through the “ini_set()” function at the stage before calling the session_start() function.