On October 23, 2026, the PHP Security Team published additional information regarding another remote code execution vulnerability, tracked as CVE-2026-115560. The vulnerability is not addressed by the security updates released on October 21, 2026.
Successful exploitation of CVE-2026-115560 requires an uncommon combination of PHP configuration and application behavior. Applications that do not change the serialization handler at runtime are not exposed to this attack vector.
Until a security update is available, the PHP Security Team recommends disabling the session upload progress feature:
session.upload_progress.enabled=0
This mitigation was previously recommended for CVE-2026-109619. Organizations that have already applied this mitigation and kept it in place do not need to take additional action specifically for CVE-2026-115560.