PHP Foundation: flip this setting off to block a new RCE bug
Set session.upload_progress.enabled=0 until the next release, the foundation says, days after php2shell.
The PHP Foundation is asking PHP operators to set session.upload_progress.enabled=0 until the next release, saying the change blocks another remote code execution vector tracked as CVE-2026-115560. According to the foundation's post, the advisory comes days after the "php2shell" issue.
Remote code execution bugs are among the most serious web vulnerabilities, because they can let an attacker run their own code on a server. The recommended setting turns off a session upload-progress feature, and the foundation presents it as a stopgap until a patched release ships.
Why it mattersPHP still powers a large share of the web, so a quick config change that closes a hole matters to a lot of sites. If you run PHP, check your php.ini and follow the foundation's guidance. The post had about 950 likes.
