New PHP warning (CVE-2026-115560): what the session upload progress advisory means for WordPress sites

Two days after the critical PHP updates of 21 October, PHP published a further advisory about a separate issue, CVE-2026-115560, that hasn't been fixed yet. It only affects an unusual setup, and PHP itself calls it unlikely. Here's what it means for a WordPress site, and the one setting worth switching off in the meantime.

What has PHP said?

On 23 October 2026 PHP published an informational advisory about session upload progress, a feature that lets PHP report how far a file upload has got. In a particular configuration it gives an attacker an unlikely route to running code on the server. PHP will publish a full advisory for CVE-2026-115560 alongside the next regular release, and until then it suggests switching the feature off.

Is my site at risk?

Probably not. According to PHP, three things all have to be true at once:

1. The site's PHP configuration sets session.serialize_handler to php_binary or php_serialize.
2. The site's own code then switches it back to php while it runs, before starting a session.
3. Session upload progress is still switched on, which it's by default.

WordPress itself doesn't use PHP sessions at all, so a standard WordPress site doesn't meet the first two conditions. Some plugins and custom code do use sessions, though, and few site owners know exactly what every plugin does. That's why switching the feature off is a cheap precaution rather than an emergency.

What to do

1. Make sure you have the 21 October update. That fixed two critical flaws that affect almost every PHP site, and it matters far more than this one. Our guide to the 21 October PHP vulnerability shows how to check.
2. Switch off session upload progress. Set session.upload_progress.enabled to 0 in your PHP settings. On most hosting that's a PHP options or "PHP INI" editor in the control panel. It can't be changed from inside WordPress, so if you can't find it, ask your host.
3. If you already switched it off on 21 October, leave it off. It was listed as a mitigation in PHP's advisory for CVE-2026-109619, so anyone who applied that's already covered.
4. Update again when the next PHP release arrives. That's when the full fix lands.

How this relates to 21 October

The two flaws fixed on 21 October, CVE-2026-109618 and CVE-2026-109619, were rated Critical and affect any site running an unpatched version of PHP. This new one is narrower: it needs a specific combination of settings and code, and PHP is handling it in its normal release cycle rather than with an emergency release. The 21 October updates don't fix it, but they're still the priority.

Why the headlines sound worse

"Unpatched" is accurate: there's no fixed version of PHP yet. What the headlines tend to leave out is how unusual the setup is, and that a one-line setting removes the risk in the meantime. If your site has the 21 October update and session upload progress switched off, there's nothing more to do until the next release.

Common questions

If you want a hand

If you aren't sure which version of PHP your site runs, or where the setting lives, get in touch and we'll happily take a look. Keeping PHP and WordPress up to date is part of our hosting and support. We look after WordPress sites, so we aren't neutral, but everything here is something you or your host can do without us.