VULNpocalypse
MediumVulnerabilityActive

PHP session upload progress RCE vector (CVE-2026-115560) with no fix yet, plus Windows builds rebuilt for Brotli

A new PHP session upload progress RCE needs an unusual setup and has no fix yet. Set session.upload_progress.enabled=0; Windows users install the -1 builds.

Published
Updated
Fixed in
CVE-2026-115560 not fixed yet (due in the next regular PHP bugfix release); Brotli fix in Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1
Exploitation
No exploitation of CVE-2026-115560 reported. Brotli CVE-2026-111497 is in CISA KEV since 27 October 2026

Live scores

CVE-2026-115560
EPSS
0.000
low predicted chance of attack
VEDAS
0.444
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-111497
EPSS
0.826
very likely to be attacked soon
VEDAS
0.977
strong exploit evidence
On CISA KEV
Yes, since 2026-10-27
Detection rule
None yet
EPSS (chance of attack)
100.1Added to CISA KEV 2026-10-27CVE-2026-111497 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9Added to CISA KEV 2026-10-27CVE-2026-111497 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

VEDAS flagged this bug about 3 days before CISA confirmed attacks.

What happened

On 23 October 2026, two days after the PHP2Shell fixes, the PHP project published an informational advisory for a new bug, CVE-2026-115560. PHP calls it “an unlikely RCE vector” and says it will be fixed in the next regular bugfix release, with a full advisory then (PHP).

It needs all three of these at once (PHP):

  1. session.serialize_handler is set to php_binary or php_serialize in the configuration.
  2. The application switches it to php at runtime with ini_set() before calling session_start().
  3. Session upload progress is still enabled.

PHP says “Applications that never change the serialize handler at runtime can keep the feature enabled.” The suggested mitigation, session.upload_progress.enabled=0, was already listed on 21 October as a mitigation for CVE-2026-109619, one of the two PHP2Shell bugs. No exploitation of CVE-2026-115560 has been reported (Infosecurity Magazine). As of 2 November, the CVE record had not been published.

Windows builds rebuilt for Brotli. On 26 October, PHP released Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They bundle Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write in Brotli decompression. In PHP Windows builds the decoder is reachable through the cURL extension when automatic HTTP response decompression is turned on. That is off by default in cURL, but applications and HTTP client libraries can enable it. The -1 suffix marks a rebuild with updated dependencies; the PHP source and runtime version are unchanged (PHP). The Brotli flaw itself has been in CISA’s KEV catalog since 27 October 2026 (CISA KEV); see our Node.js advisory for the wider picture.

Am I affected?

CVE-2026-115560. Check the effective settings for the PHP that serves web requests, not just the CLI:

bash
# CLI view; FPM pools and Apache can override these
php -i | grep -E 'session\.(upload_progress\.enabled|serialize_handler)'

# Settings in FPM pools and ini files
grep -rnE 'session\.(upload_progress\.enabled|serialize_handler)' /etc/php* /usr/local/etc/php* 2>/dev/null

# Application code that changes the handler at runtime
grep -rnE "ini_set\(\s*['\"]session\.serialize_handler" --include='*.php' /var/www

You are exposed only if the configured handler is php_binary or php_serialize, some code switches it to php with ini_set(), and upload progress is on (the PHP default is on). If the third grep finds nothing, the bug cannot be reached through your own code; plugins and vendor libraries count, so include them in the search path.

Windows Brotli. php -v prints the same version for the original and the -1 build, because the PHP runtime is unchanged. Check which package you deployed: the download file name carries the -1 suffix. You are only exposed if your code or an HTTP library turns on automatic response decompression in cURL (for example CURLOPT_ENCODING set to an empty string or a list that includes br).

What to do now

  1. Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration, and restart every PHP worker. PHP’s 21 October advisory says not to rely on ini_set() or FPM .user.ini for this setting, because it must apply before request parsing (PHP). For an FPM pool, use php_admin_value[session.upload_progress.enabled] = 0 so applications cannot override it.
  2. Confirm PHP2Shell is patched while you are there: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. That fix is separate from this one.
  3. If you must keep upload progress, remove the runtime ini_set('session.serialize_handler', ...) call so the handler stays as configured.
  4. On Windows, install 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1 from the PHP Windows downloads, and restart IIS or the PHP service.
  5. Watch for the next PHP bugfix release, which PHP says will fix CVE-2026-115560 and include the full advisory. Keep the mitigation until you run it.

Sources