Executive Summary

BGD e-GOV CIRT alerts organizations to a newly disclosed PHP remote code execution vulnerability, tracked as CVE-2026-115560. The issue concerns an interaction between PHP session serialization and the session upload progress feature that may create an RCE condition under a specific and unusual application configuration.

The published technical guidance indicates that the vulnerable condition requires all of the following:

·   The application configures session.serialize_handler as php_binary or php_serialize.

·   Application code subsequently switches the handler to php at runtime using ini_set().

·   The handler change occurs before session_start() is called.

·   Session upload progress remains enabled.

PHP's published guidance describes this as an unlikely exploitation path and recommends disabling session upload progress until a regular bug-fix release becomes available.

At the time of publication, a complete technical advisory, a confirmed affected-version range, and a final severity score had not been published. No exploitation of CVE-2026-115560 had been reported in the sources reviewed for this advisory. Organizations should nevertheless apply the recommended mitigation, verify their application configuration, and monitor for further security updates.

Immediate action: Set session.upload_progress.enabled=0 through an administrator-controlled PHP configuration, restart all relevant PHP workers, and test applications that rely on upload-progress functionality..

Vulnerability Overview

CVE-2026-115560 involves PHP's session handling behavior when an application changes the session serialization handler at runtime while session upload progress is enabled.

PHP supports multiple session serialization handlers. These handlers determine how session data is represented and processed. Session upload progress allows an application to track the progress of an uploaded file, typically to provide progress information to a user.

According to the published guidance, a specific combination of session-handler configuration and runtime behavior can create an unlikely RCE vector.

The exact low-level exploitation mechanism has not been fully documented in the public informational notice. Accordingly, this advisory does not assume a particular exploit payload, memory-corruption primitive, or post-exploitation outcome beyond the reported potential for remote code execution.

Full Details Below: