PHP Foundation Recommends Temporarily Disabling Upload Progress Feature
The PHP Foundation recommends setting `session.upload_progress.enabled` to 0 before the next PHP release to mitigate the RCE vulnerability CVE-2026-115560. Applications that dynamically switch the non-default `serialize_handler` to "php" at runtime may be affected. The Foundation had previously advised keeping this feature disabled due to CVE-2026-109619.
The PHP Foundation recommends temporarily disabling the upload progress feature.
The PHP Foundation advises users to set session.upload_progress.enabled to 0 before the next PHP version is released, in order to mitigate the RCE vulnerability tracked as CVE-2026-115560. Only applications that switch from the default serialize_handler to a non-default one at runtime may be affected.
The Foundation had previously recommended keeping this feature disabled due to CVE-2026-109619.
The PHP Foundation(@ThePHPF)