IT & SecurityCreated on October 25, 20262 min read

PHP follow-up: check session upload progress after the critical update

An October 23 follow-up covers an unusual session configuration. Check whether the temporary mitigation applies to your application.

What changed

After the October 21 security releases, PHP published a separate follow-up for CVE-2026-115560. It recommends disabling session upload progress until the next regular bugfix release. This follow-up does not announce a fixed version.

Who should check

The specific condition combines upload progress with a configured php_binary or php_serialize session handler that application code changes to php using ini_set() before session_start(). PHP says applications that never change the handler at runtime may keep the feature enabled.

What to do

Check the configuration actually used by the web workers and search the application for runtime session-handler changes.
If applying the mitigation below, put it in the server configuration before request parsing and restart every worker through your normal deployment process. An application-level ini_set() is insufficient.
Keep the October 21 runtime patches: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or confirmed vendor backports. The configuration follow-up does not replace those updates.

Reference commands

Temporary mitigation in the active server configuration

session.upload_progress.enabled = 0

Verify the result

Test login, session persistence and uploads in staging. Record the active web configuration and the vendor package installed after deployment. Keep the mitigation if already applied; recheck PHP’s next release before removing it.

Official sources

PHP.net · 23 October follow-up and 21 October advisory

Take it into your project

Get the files, keep the guide, or give your coding assistant a ready-to-use brief.

Download guideMarkdown Download AI setup briefEnglish · Markdown

Set it up with AI

Copy this English prompt into your coding assistant. It includes the article, available files and project setup steps.

View the setup prompt

AI setup prompt · English

Read this news or bug-fix article as reference material:
https://nethanelfitoussi.com/article/php-upload-progress-october-2026?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Use the article and its examples as references. Identify any missing project files before making changes.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Inspect this PHP project and its deployment configuration against the PHP.net notices of 21 and 23 October 2026: https://www.php.net/archive/2026.php . Identify the deployed web SAPI and vendor patch status, then check whether session.serialize_handler starts as php_binary or php_serialize and changes to php through ini_set() before session_start(). Check whether upload progress is enabled. Do not treat the CLI configuration as proof of the web configuration. Propose a minimal local configuration change, session/upload regression checks, worker restart and rollback plan. Do not change production or expose phpinfo publicly. Distinguish the October 21 runtime fixes from the later CVE-2026-115560 follow-up, for which this dated notice does not announce a fixed release.

Check the dated advisory and current official vendor guidance. Identify whether my installed version and configuration are affected before proposing a fix.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.

The prompt

Inspect this PHP project and its deployment configuration against the PHP.net notices of 21 and 23 October 2026: https://www.php.net/archive/2026.php . Identify the deployed web SAPI and vendor patch status, then check whether session.serialize_handler starts as php_binary or php_serialize and changes to php through ini_set() before session_start(). Check whether upload progress is enabled. Do not treat the CLI configuration as proof of the web configuration. Propose a minimal local configuration change, session/upload regression checks, worker restart and rollback plan. Do not change production or expose phpinfo publicly. Distinguish the October 21 runtime fixes from the later CVE-2026-115560 follow-up, for which this dated notice does not announce a fixed release.

Read the original sourcePHP.net · 23 October follow-up and 21 October advisory

PHPSecuritySessionsCVE-2026-115560