Status on October 23, 2026: PHP has published an informational advisory for CVE-2026-115560, but no PHP version fixes it yet.
PHP will publish the full advisory and the fix with its next regular release, and this page will be updated then.
¶ Summary
CVE-2026-115560 is a remote code execution flaw in PHP session handling.
PHP rates it an "unlikely RCE vector", because it needs three conditions in the same application:
- the PHP configuration sets
session.serialize_handlertophp_binaryorphp_serialize; - the application switches it back to
phpat runtime withini_set(), before callingsession_start(); - session upload progress (
session.upload_progress.enabled) is still enabled.
An application that never changes the serialize handler at runtime is not affected and can keep upload progress enabled.
Until the fix is released, PHP recommends setting session.upload_progress.enabled = 0.
¶ Relation with CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are the two PHP2Shell flaws fixed by PHP on October 21, 2026. CVE-2026-115560 was announced two days later.
| CVE | Flaw | Fixed in | Interim mitigation |
|---|---|---|---|
| CVE-2026-109618 (PHP2Shell) | Unauthenticated remote code execution through out-of-memory corruption | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 | memory_limit and post_max_size limits |
| CVE-2026-109619 (PHP2Shell) | Unauthenticated remote code execution through stale global state | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 | session.upload_progress.enabled = 0 |
| CVE-2026-115560 | Remote code execution when the application changes the serialize handler at runtime | Not fixed yet | session.upload_progress.enabled = 0 |
CVE-2026-115560 is a separate flaw.
The October 21 releases do not fix it, and neither does the PHP 7.3 package published by Freexian for Debian 10.
It uses the same mitigation as CVE-2026-109619.
PHP states that if you applied session.upload_progress.enabled = 0 for PHP2Shell, you should keep it in place and no further action is needed.
PHP2Shell remains the urgent problem:
it works against PHP web applications with default settings, while CVE-2026-115560 needs application code that few applications contain.
¶ How Artica is affected
| Component | Exposure |
|---|---|
| Web Console | Not exposed. The php.ini generated by Artica sets session.serialize_handler = php and the console never changes it at runtime, so the first condition is never met.Since Service Pack 10 Hotfix 20261021-14, upload progress is also off for PHP2Shell. |
| Background tasks run by the system | Not exposed. They do not answer HTTP requests. |
| PHP websites published by the reverse proxy | Artica applies the same settings: serialize handler php and upload progress off.A third-party application could be exposed only if its own code changes the serialize handler at runtime and upload progress was switched back on for that site. |
An appliance that already has the PHP2Shell mitigation needs no new update for CVE-2026-115560.
¶ Check your appliance
Open the Packages center page of the Web Console (https://your-appliance:9000/packages-center).
The PHP Version line gives the engine used by the console.
Click the version number to display the PHP information of the console, then check two lines:
session.serialize_handlermust bephp;session.upload_progress.enabledmust beOff.
If session.upload_progress.enabled shows On, the appliance does not have the PHP2Shell mitigation yet. Install the latest hotfix as described in PHP2Shell remote code execution in PHP.
Do not edit
php.iniby hand on an appliance.
Artica regenerates the file and a manual change would be lost.
¶ Websites published by the reverse proxy
If you publish a third-party PHP application, ask its developer whether it changes session.serialize_handler at runtime.
If it does, keep upload progress off for that site.
The WAF rule described in CVE-2026-109618 and CVE-2026-109619: protect PHP websites with the reverse proxy
refuses requests that carry the PHP_SESSION_UPLOAD_PROGRESS field, the field that starts the upload progress feature.
It therefore also blocks the path used by CVE-2026-115560.
¶ When PHP releases the fix
- Debian 12 and Debian 13: upgrade the system to install the fixed PHP packages used by the Web Console.
- Websites published by the reverse proxy:
Their PHP engine is updated by an Artica package. - Debian 10: the PHP project no longer maintains PHP 7.3. Keep the mitigation in place and plan the migration (see Debian 10 upgrade status).