What happened
PHP published an advisory for CVE‑2026‑115560, describing a code‑execution path that requires the session.serialize_handler to be set to php_binary or php_serialize, changed to php at runtime via ini_set() before session_start(), and with session.upload_progress.enabled left on. No active exploits have been reported.
Why it matters for trust and compliance
- The flaw highlights the need for continuous verification of secure configuration baselines and the collection of immutable logs that prove controls are enforced—a core requirement for audit readiness across frameworks.
- Continuous monitoring of runtime configuration provides real‑time evidence that secure defaults are enforced.
- Retaining change‑management logs creates a defensible audit trail for regulators and enterprise buyers.
Who is affected
TECH_SAAS OTHER
Recommended actions
- Audit all PHP instances for the described configuration and disable session.upload_progress.enabled if the risky combination is not required.
- Apply the forthcoming PHP release that patches CVE‑2026‑115560.
- Integrate configuration checks into your continuous monitoring platform and retain logs as compliance evidence.
Details
- CVEs
- CVE-2026-115560