CVE-2026-115560 is a potential remote code execution issue in PHP, disclosed by the PHP project in an informational advisory rather than a full security advisory. PHP has not yet published a technical write-up, a CWE classification, a CVSS score, or the list of affected and fixed versions, and has said it will publish the complete advisory alongside the next release.

The exposure is tied to session upload progress, a feature that is enabled by default and lets an application track how far a file upload has got. PHP describes the problem as arising from an unusual combination of configuration and application behaviour rather than from the feature alone. An application must set session.serialize_handler to php_binary or php_serialize in its configuration, then change that setting to php at runtime through ini_set(), and make that change before it calls session_start().

Session upload progress must also still be enabled. Where all of those conditions hold, PHP says an unlikely remote code execution vector exists. A default PHP installation does not meet that bar on its own; session upload progress is on by default, but the runtime change to the serialize handler can only come from the application itself, which is why PHP calls the combination unlikely in practice.

PHP has not explained the underlying mechanism in detail, and it has not said whether this issue shares a root cause with CVE-2026-109619, the stale global state flaw patched on October 21. What is documented is the mitigation overlap: session.upload_progress.enabled=0 was already listed as a mitigation for CVE-2026-109619, so organisations that applied it then are already covered and need to take no further action. Because the attack path depends on the application changing a session setting at runtime, the practical attack surface is far smaller than the installed base of PHP, and an application that keeps a single serialize handler throughout its lifecycle is not reachable through this path. PHP judged the setup uncommon enough to handle the fix in its regular release cycle rather than as an out-of-band emergency, a notable contrast to its handling of the two PHP2Shell flaws two days earlier.

Risk evaluation is limited by what the vendor has released. No CVSS vector or base score has been published for CVE-2026-115560, no affected version range has been confirmed, and no fixed release has been named, so severity should be treated as unrated for now. There is also no evidence of exploitation: public reporting records no attacks against CVE-2026-115560, and the exploitation activity observed since October 17 targets CVE-2026-109618 and CVE-2026-109619 instead.