A PHP project developers have warned of the discovery of another vulnerability (CVE-2026-115560) that could potentially be used for remote code execution on a server under a specific rare combination of non-standard settings (not in the default configuration) and executable PHP code. Details about the vulnerability will be published once the next patch releases of PHP are ready.
As a workaround for protection, it is recommended to set the parameter "session.upload_progress.enabled=0" in php.ini, which was also advised as a measure to block the previous critical vulnerability. The issue occurs when the parameter "session.serialize_handler" is set to "php_binary" or "php_serialize", and this parameter is changed in the PHP code to "php" through the "ini_set()" function before calling the "session_start()" function.
Forrás: opennet.ru
