What happens inside PHP
Upload-progress tracking uses session serialization before application handling. Changing the serializer for a later read can interpret that stored data differently. A source-reviewed community repository supplies an object-injection lab with a deliberately added gadget; reproduction is reported by its author.
The PHP notice describes an unusual configuration-and-code combination. Applications that never change the serializer at runtime do not meet that described path. The public lab’s command-execution gadget is not evidence that every application has an equivalent chain.
Check the prerequisites
All three conditions below are required for the path described in PHP’s 23 October notice.
- The configured session.serialize_handler is php_binary or php_serialize.
- Application code uses ini_set() to switch the handler to php before session_start().
- session.upload_progress.enabled remains enabled.
Affected versions & patch status
PHP’s 23 October notice does not give a complete affected-version range or a fixed release. The original PHP2Shell release numbers must not be used as a clearance test for this separate issue.
No fixed-version or PHP CVSS matrix yetAs of this source check, PHP has announced a regular-cycle follow-up but has not published the full advisory. This page does not inherit the original pair’s 9.2 score or release baselines.
Respond to this CVE
- The reviewed PHP notice schedules the fix and full advisory for the next regular release. No fixed release is identified in that notice as of 24 October.
- Keep the original PHP2Shell patches installed. They address CVE-2026-109618 and CVE-2026-109619, not this separate condition.
Apply the PHP-recommended mitigation
- PHP recommends disabling session upload progress while awaiting the regular fix. Keep it disabled if already applied.
- Apply the setting in the web runtime configuration before request parsing, then replace or restart every affected worker. Do not rely on application ini_set() for this directive.
- This setting addresses the stated session-progress path for CVE-2026-115560. It remains only a partial control for the original PHP2Shell memory-corruption issues.
; Apply in php.ini or the serving SAPI configuration.
; Restart or replace all PHP workers afterward.
session.upload_progress.enabled = 0
Patch guide → · Runtime and infrastructure controls →
Verify on your own systems
- Read the effective web-runtime serializer and upload-progress settings; CLI configuration alone is insufficient.
- Review application and dependency code for runtime changes to session.serialize_handler before session_start(). A text search locates candidates; it cannot prove execution order or absence of dynamic changes.
- Check all three prerequisites together. The published scenario does not require an application-facing upload form; inspect what the PHP runtime actually parses.
- Confirm the disabled setting on every serving instance. Follow PHP’s next advisory for the eventual fixed-version matrix.
Local Linux inventory helper · Private web-runtime verification
Monitoring ideas
- Investigate unexpected concurrent upload/session traffic and session-decode warnings in the same application context.
- A session decoding warning can also have benign causes. Pair it with the runtime settings, application code, request logs and host evidence.
Open the detection and monitoring guide →
PoCs & related research
These links are source-reviewed examples and related research. No exploit was executed for this site. Read each repository’s prerequisites and limitations before using an isolated lab.
Lab for the separate CVE-2026-115560 serializer mismatch, with a deliberate runtime handler switch and synthetic destructor gadget. Includes upload-progress-disabled and no-switch controls on PHP 8.4.27 Apache.
Source inspected; not executed. The gadget and writable result directory are supplied by this lab. Its check subcommand reads the lab's info.php and checks server configuration; it cannot verify an application's runtime switch or establish exploitability. The image is version-tagged, not digest-pinned.
Pinned source links & review notes →Primary sources & provenance
Source snapshot: 2026-10-24. Documentary review only; no exploit or infrastructure validation performed. Structured CVE data · All references.
