# CVE-2026-115560: What PHP's Session Upload Progress Advisory Means for Your Sites

> CVE-2026-115560 is a new, lower-risk PHP issue with no fix yet. PHP's advice is session.upload_progress.enabled=0, already applied on xCloud since 21 October.

**Short answer: if your sites run on xCloud, you are already protected against CVE-2026-115560, and you don't need to do anything.** PHP's recommended step for this new issue is the same mitigation we applied to **all xCloud servers, Managed and Self-Managed, on 21 October 2026**, and it is still in place.

On 23 October 2026, PHP published an **informational advisory** about **CVE-2026-115560**, a new issue in **session upload progress**. It came two days after the critical [**PHP2Shell security release**](/php2shell-vulnerability/), so many of you asked the same question: is this PHP2Shell again, and do I need to act?

It is not PHP2Shell, and **PHP2Shell is patched on xCloud**: more than 95% of xCloud servers already run PHP's official fixed builds. Below, we explain what CVE-2026-115560 is, why it is lower risk, what PHP recommends, and the one case where you still need to do something yourself.

## **TL;DR: CVE-2026-115560 in 30 Seconds**

- **What it is:** a PHP issue in session upload progress that PHP calls an **"unlikely RCE vector"**. It only occurs with an unusual combination of configuration and application code.
- **Fixed?** **Not yet.** PHP will fix it in its **next regular bugfix release**, not an emergency one. No host can install a fix today.
- **PHP's advice until then:** set **`session.upload_progress.enabled=0`**. PHP adds: "If you applied it then, keep it in place and no further action is needed."
- **On xCloud:** that setting has been applied on all xCloud servers **since 21 October**, it stays in place after patching, and new PHP installs get it too. **You don't need to do anything.**
- **Not the same as PHP2Shell:** PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was fixed on 21 October, and xCloud rolled out those fixed builds.
- **Only action:** if you run PHP **inside your own Docker containers**, set the value there yourself.

## **What Is CVE-2026-115560?**

CVE-2026-115560 is a vulnerability in PHP's **session upload progress** feature, the part of PHP that can report how far a file upload has got by writing it into the user's session. PHP announced it on **23 October 2026** in an informational advisory on [**php.net**](https://www.php.net/archive/2026.php#2026-10-23-1).

PHP describes it as an **unlikely remote code execution (RCE) vector**. According to PHP, the issue can only occur when all of these are true at once:

1. The application sets **`session.serialize_handler`** to `php_binary` or `php_serialize` in its configuration.
2. It then switches the handler to `php` at runtime with **`ini_set()`**, before calling **`session_start()`**.
3. **Session upload progress** is still enabled.

Most applications never change the session serialize handler at runtime, and PHP notes those can keep the feature enabled. That is why PHP is handling it in its regular release cycle, and why it will publish a full advisory with the fix in the next release. No exploitation has been reported.

## **Is CVE-2026-115560 the Same as PHP2Shell?**

No. They are separate issues, and they are in different states:

| | **PHP2Shell (CVE-2026-109618, CVE-2026-109619)** | **CVE-2026-115560** |
|---|---|---|
| Announced | 20 October 2026 | 23 October 2026 |
| Risk | Critical, CVSS v4.0 9.2, public exploit code | PHP calls it an unlikely RCE vector, no exploitation reported |
| Official PHP fix | ✅ Released 21 October (8.5.12, 8.4.27, 8.3.36, 8.2.35) | ⏳ Next regular bugfix release |
| On xCloud | ✅ Fixed builds rolled out, more than 95% of servers patched | ✅ Mitigated since 21 October, mitigation stays in place |
| Your action on xCloud | Only for old PHP, NGINX on Ubuntu 20.04 or Docker | None, unless you run PHP in your own Docker containers |

The two are linked by one setting. When PHP published its PHP2Shell advisory on 21 October, it listed **`session.upload_progress.enabled=0`** as a mitigation for CVE-2026-109619. The new advisory recommends the same setting for CVE-2026-115560. The full PHP2Shell story is in our [**PHP2Shell post**](/php2shell-vulnerability/).

## **How xCloud Already Protects Your Servers**

On **21 October 2026**, hours before PHP released its PHP2Shell fix, we started applying a temporary mitigation to PHP on **all xCloud servers, Managed and Self-Managed**. That mitigation is **`session.upload_progress.enabled=0`**, the exact step PHP now recommends for CVE-2026-115560.

A few details matter here:

- **It applies where PHP asks.** PHP says the setting must come from `php.ini`, an FPM pool or server configuration, not from `ini_set()` or `.user.ini`. On xCloud it is set in PHP's configuration and locked in each PHP-FPM pool and OpenLiteSpeed virtual host, so a site cannot switch it back on.
- **It stayed in place after patching.** Installing the PHP2Shell fixes did not remove it, and it stays in place as an extra layer.
- **New PHP installs get it too.** A PHP version you install on xCloud today comes with the setting already off.
- **Disconnected servers catch up.** We retry servers that were unreachable once a day, at 19:00 UTC, so they get the mitigation within a day of reconnecting.

It is still **a temporary mitigation, not a complete fix**. When PHP ships the fix in its next release, we will install it on xCloud servers, as we did for PHP2Shell. Every PHP2Shell change is listed in the [**v2.9.4 security release notes**](/changelog/v2-9-4/) and the [**v2.9.5 release notes**](/changelog/v2-9-5/).

## **Do You Need to Do Anything?**

| **Your setup** | **Protected?** | **Your action** |
|---|---|---|
| PHP sites on an xCloud server (NGINX or OpenLiteSpeed) | ✅ Yes, since 21 October | None |
| A PHP version you installed on xCloud after 21 October | ✅ Yes, set on install | None |
| A server that was disconnected this week | ⏳ Within a day of reconnecting | Reconnect it, or [**contact support**](/contact/) |
| PHP inside your own Docker containers | ❌ Not covered by xCloud | Set `session.upload_progress.enabled=0` in your images |
| PHP on another host | Depends on your host | Follow the steps below |

**Please don't turn session upload progress back on** on xCloud servers. It is off for a reason, and very few apps need it.

## **Not on xCloud? How to Apply PHP's Recommended Step**

If you manage PHP yourself, you can apply the same mitigation in a few minutes:

1. **Set the value where PHP reads it before a request starts:** add `session.upload_progress.enabled = 0` to `php.ini`, or `php_admin_flag[session.upload_progress.enabled] = off` to each PHP-FPM pool. Don't rely on `ini_set()` or `.user.ini`, which apply too late.
2. **Restart every PHP worker**, for example PHP-FPM or LSPHP, so no worker keeps the old value.
3. **Check it:** `phpinfo()` should show `session.upload_progress.enabled` as **Off** for each PHP version that serves a site.
4. **Make sure you are on a PHP2Shell-patched build:** 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. If you run WordPress, our [**PHP2Shell checklist for WordPress on any host**](/php2shell-wordpress/) covers patching and compromise checks.

Turning the feature off rarely breaks anything. It only powers upload progress bars that read PHP's session data during an upload, and WordPress, WooCommerce and most PHP apps do not use it. Normal file uploads keep working.

## **Timeline**

We will update this timeline when PHP releases its fix.

- **21 October 2026, from 06:00 UTC:** xCloud starts applying `session.upload_progress.enabled=0` to all xCloud servers, Managed and Self-Managed, as a PHP2Shell mitigation.
- **21 October 2026, 14:00 UTC:** PHP releases the PHP2Shell fixes. Its advisory lists the same setting as a mitigation for CVE-2026-109619.
- **23 October 2026:** PHP publishes an informational advisory for CVE-2026-115560 and recommends the same setting until its next regular release. xCloud servers are already covered.
- **Next PHP bugfix release:** PHP fixes CVE-2026-115560 and publishes a full advisory. xCloud installs the fixed builds.

## **Stay Protected Without Chasing Every Advisory**

Two PHP advisories in three days is a lot to follow if you run servers yourself. On xCloud, we read each one, apply mitigations across the platform and roll out the official fixes, then tell you plainly whether anything is left for you.

Want to see where each of your servers stands? Open **Manage PHP** on any server, or read our guide on [**how to upgrade PHP and install security patches on xCloud**](/docs/how-to-upgrade-php-version-with-xcloud-hosting/). Still on old PHP or Ubuntu 20.04? Our [**PHP versions compatibility table**](/docs/php-versions-compatibility-in-xcloud/) shows what each server can run, and [**full server clone**](/docs/how-to-clone-full-server-with-xcloud/) moves everything to a new server in one go.

**New to xCloud?** See how [**managed hosting**](/managed-hosting/) and [**WordPress hosting**](/hosting-for-wordpress/) on xCloud keep security work off your plate, and browse our [**web hosting security best practices**](/web-hosting-security-best-practices/).

If you have found this blog helpful, feel free to [**subscribe to our blogs**](https://xcloud.host/blog/) for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our [**Facebook community**](https://www.facebook.com/groups/xcloud.community) to share insights and engage in discussions.

## **Frequently Asked Questions**

### **What is CVE-2026-115560?**

It is a PHP vulnerability in session upload progress that PHP announced on 23 October 2026 in an informational advisory. PHP calls it an unlikely remote code execution vector, because it only occurs with an unusual combination of configuration and application code. PHP will fix it in its next regular bugfix release.

### **Is CVE-2026-115560 fixed?**

Not yet. No PHP release fixes it today, so no host can install a fix. PHP will publish the fix and a full advisory with its next regular release. Until then, PHP recommends setting session.upload_progress.enabled=0.

### **Is CVE-2026-115560 the same as PHP2Shell?**

No. PHP2Shell is CVE-2026-109618 and CVE-2026-109619, which PHP fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CVE-2026-115560 is a separate issue that those releases do not fix. It is also much less likely to be exploitable.

### **Are xCloud servers protected against CVE-2026-115560?**

Yes. PHP's recommended step, session.upload_progress.enabled=0, is the mitigation xCloud applied to all xCloud servers, Managed and Self-Managed, on 21 October 2026 for PHP2Shell. It stays in place after patching, and new PHP installs on xCloud get it too. xCloud customers do not need to do anything.

### **Do I need to change any PHP settings on xCloud?**

No. The setting is already applied and locked on xCloud servers. Please don't turn session upload progress back on. If you run PHP inside your own Docker containers, set session.upload_progress.enabled=0 in those images yourself, because xCloud only manages PHP installed on the server.

### **How do I apply the mitigation if I'm not on xCloud?**

Set session.upload_progress.enabled=0 in php.ini, in each PHP-FPM pool or in your web server configuration, then restart every PHP worker. PHP's 21 October advisory warns not to rely on ini_set() or .user.ini, because those apply too late. Then check with phpinfo() that the value is off.

### **Will turning off session upload progress break my site?**

Very rarely. The setting only powers upload progress bars that read PHP's session data during an upload. WordPress, WooCommerce and most PHP apps do not use it, and normal file uploads keep working.