PHP CVE-2026-115560 session upload progress RCE has no patch yet: am I affected and how do I apply the session.upload_progress.enabled=0 workaround?

Am I affected? This is separate from PHP2Shell (CVE-2026-109618/109619, patched October 21; upgrade for that first). PHP disclosed CVE-2026-115560 on October 23, 2026 with no fixed release yet. It only applies when ALL of these are true: - session upload progress is enabled (session.upload_progress.enabled=1, which is the default), - the configured session.serialize_handler is php_binary or php_serialize, - the application switches session.serialize_handler to php at runtime with ini_set() and then calls session_start(). How to check: - php -i | grep -E 'session.upload_progress.enabled|session.serialize_handler' (check the web SAPI too, e.g. a phpinfo() page on a private host or the FPM pool config). - Search your code and vendor/ for runtime handler changes: grep -rn "serialize_handler" --include=*.php . Workaround (until PHP ships a fix): - Set session.upload_progress.enabled=0 in php.ini, the FPM pool config (php_admin_value) or the web server config, then restart every PHP worker (php-fpm, Apache, FrankenPHP, LiteSpeed). - It has to apply before the request is parsed, so ini_set() in code and .user.ini files don't work for this. - Side effect: upload progress bars that rely on this feature stop working. Try it on staging first. After applying: - Confirm the value is 0 from the web SAPI, not just the CLI (they often read different php.ini files). - Watch php.net releases and your distro's security tracker for the fix, then upgrade and decide whether to re-enable the feature. Sources: https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ https://thebackroomtech.com/php-mitigation-unpatched-rce-vulnerability-cve-2026-115560/ https://brandefense.io/security-news/php-cve-2026-115560-session-upload-progress-rce/ https://www.php.net/manual/session.upload-progress.php