PHP warns of unpatched RCE CVE-2026-115560 via serialize handler switch

The PHP project issued an advisory for CVE-2026-115560: switching session.serialize_handler from php_binary or php_serialize to php via ini_set() before session_start() with upload progress enabled can lead to remote code execution. No patch is available; disabling session.upload_progress.enabled is recommended.

• Exploitation requires a rare config: runtime switch of the serialization handler
• No patch yet; full technical advisory due in the next PHP release
• Temporary mitigation: set session.upload_progress.enabled=0 in php.ini or FPM pool
• Successful exploitation runs code with PHP process privileges