Security AlertHigh
PHP warns of another code execution risk
Oct 23, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
PHP says a narrow setup could let an attacker run code on a web server. It is not issuing an emergency fix and recommends turning off session upload progress until the next routine release.
Key points
- The issue is CVE-2026-115560.
- PHP says the risk applies to an unusual setup.
- No exploitation has been reported for this issue.
Why it matters
If your site runs PHP and uses session upload progress, you should check the setting now. The safer move is to disable the feature until a fix is released.
Who’s affected: Some PHP web applications
What to do
- Disable session.upload_progress.enabled.
- Review your PHP configuration.
- Follow the next routine PHP release.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.