A new PHP vulnerability, CVE-2026-115560, was posted to the oss-security list on 23 October and concerns the session serialisation mechanism. The problem only affects applications that change the session.serialize_handler setting, which is not the default. The emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 of 21 October do not fix it. As a temporary measure, turning off session.upload_progress.enabled is recommended until a fix ships.

What it means: After last week's emergency updates, many administrators may think PHP is now safe. The new flaw shows that is not true for every installation, although the risk is limited, since it only concerns those who have changed how sessions are serialised. For Greek e-shops, CMS sites and applications running on PHP, the first step is a simple check: search php.ini, the web server configuration and the application code for any change to session.serialize_handler. If there is none, the installation is not affected by this particular flaw. If there is, turning off session.upload_progress.enabled is a quick measure, but first check that no feature, such as upload progress bars, depends on it. On shared hosting the setting is usually controlled by the provider, so a message to support is worthwhile. Either way, updating to the 21 October releases remains essential for the two critical flaws fixed that day. Administrators should also watch PHP's announcements for the new fix and plan one more update cycle.

Read the original on oss-security (Openwall)

Related service: Custom software

Related stories