CVE-2026-115560: the third PHP bug the 21 October patch does not close

After the two critical bugs on 21 October it is easy to decide that "PHP is updated, the topic is closed." On 23 October the project described a third one, CVE-2026-115560. There was no extra out-of-band release for it. CERT-EU the same day said it affects an unusual configuration and did not get an emergency build. That is not a reason to ignore it if the setting is on. It is a reason not to panic if you never touched it.

In plain language

PHP can write into the session how far a file upload has gone. On an ordinary site with an "attach a resume" form that feature is usually off, and then this bug is not yours. If someone turned it on for a progress bar and forgot, the interpreter can again be made to run code before the application. No login is required. The 21 October patch does not touch this path.

What PHP itself says

Until the next regular bugfix release, the project recommends setting session.upload_progress.enabled to 0 and restarting the workers. The same setting also removes one confirmed path into CVE-2026-109619, so it is worth keeping off after the upgrade. It is not a substitute for patching the first two bugs. A site on 8.1 without a backport still needs to come off the public internet.

A WAF can drop some requests that poke this feature. That is temporary. A rule does not know whether the setting is on, and it does not replace a line in php.ini. If you are unsure whether it is enabled, that is one concrete question for the host or one line in the config, not a "full audit of everything."

What to do this week

• Check session.upload_progress.enabled. If it is On, or unset where you do not want the default, set it to 0 and restart PHP.
• Do not treat the October release as the whole PHP story. It closes two bugs. It does not close the third.
• On shared hosting, ask support for the setting and the PHP version, not a screenshot that says everything is updated.