PHP shares mitigation for new RCE vulnerability with no patch

The PHP security team published mitigation guidance for a new remote code execution flaw tracked as CVE-2026-115560, which has no patch yet. It only affects systems that switch session.serialize_handler to php_binary or php_serialize at runtime while session upload progress is enabled. The temporary fix is to set session.upload_progress.enabled=0.

• CVE-2026-115560 requires an unusual configuration and code combination
• Temporary mitigation is setting session.upload_progress.enabled=0
• A full patch will ship in the regular PHP release cycle
• PHP powers about 70% of websites, with over 5.1 million hosts online