PHP security advisory (CVE-2026-115560): mitigation recommended

Update timeline

1. investigating Oct 23, 2026, 12:00 PM UTC

   Status: Investigating impact The PHP project has published an informational advisory about a further vulnerability (CVE-2026-115560). It is a potential remote code execution vector in PHP’s session handling. The PHP project rates it as unlikely to occur in practice, because it requires an unusual combination of configuration and application code. We are aware of the advisory and are currently investigating the impact on our products and customers. To be on the safe side, we recommend that customers apply the mitigation recommended by the PHP project now: set session.upload_progress.enabled=0 in your PHP configuration and restart PHP. If you already applied this setting following the PHP advisory of 21 October 2026 (CVE-2026-109619), no further action is needed. A full fix will follow in the next regular PHP release. We also continue to recommend updating to the fixed PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (the fixes for the 21 October advisory). We will update this notice as soon as we have more information. How to apply the mitigation Self-managed servers (VPS/VDS/Dedicated, no control panel) Edit the relevant php.ini (or a conf.d override) and set session.upload_progress.enabled = 0. Restart PHP-FPM or Apache (e.g. systemctl restart php8.x-fpm or systemctl restart apache2). Check with php -i | grep upload_progress or a phpinfo() page. Set this in php.ini or the FPM pool/server config. The PHP project advises against relying on ini_set() or .user.ini, because the setting must apply before request parsing. cPanel/WHM In WHM, go to Software → MultiPHP INI Editor. Choose the PHP version and open Editor Mode. Add or set session.upload_progress.enabled = 0 and save. Repeat for every installed PHP version. Restart PHP-FPM if the change is not applied automatically. Customers without WHM access can use cPanel’s MultiPHP INI Editor per domain. Server-wide configuration by the administrator is preferred, see the note below. Plesk Server-wide: Tools & Settings → PHP Settings, select the PHP version, and add session.upload_progress.enabled=0 under Additional configuration directives (or edit the php.ini tab). Per subscription: Websites & Domains → [domain] → PHP Settings, add the same line under Additional configuration directives, then click Apply. Repeat for every PHP version in use.

2. monitoring Oct 23, 2026, 02:31 PM UTC

   The mitigation (session.upload_progress.enabled=0) is implemented on all our webspace systems.