The developers of the PHP project have warned of another vulnerability (CVE-2026-115560) that could potentially be exploited for remote code execution on the server when certain rare combinations of non-standard settings (not in the default configuration) and executed PHP code are present. Details about the vulnerability will be published once the next corrective releases of PHP are ready.
As a workaround for protection, it is recommended to set the parameter "session.upload_progress.enabled=0" in php.ini, which was also suggested as one of the measures to block a previous critical vulnerability. The issue arises when the "session.serialize_handler" parameter is set to "php_binary" or "php_serialize" in the settings, and this parameter is changed in the PHP code to "php" using the "ini_set()" function before calling the "session_start()" function.
Source: opennet.ru
