Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
BREACH WATCH BRIEF High 🐛 Vulnerability

New Unpatched PHP RCE (CVE‑2026‑115560) Exploits Rare Config Combination; Mitigation Recommended

PHP disclosed CVE‑2026‑115560, a remote‑code‑execution flaw that requires a specific runtime configuration change. The team advises disabling session upload progress as a temporary mitigation. This highlights the need for continuous configuration monitoring and control‑mapping evidence for audit readiness.

ADTP Breach Watch · October 23, 2026 · BleepingComputer
SeverityHigh
Type🐛 Vulnerability
ConfidenceHigh
ReportedOct 23, 2026
Technology & SaaS Web application developers Hosting providers SaaS platforms using PHP Vulnerability Exploit Zero-Day Exploit

What happened

The PHP security team announced CVE‑2026‑115560, an RCE that can be triggered only when an application changes session.serialize_handler at runtime while session.upload_progress.enabled remains on. No patch exists; the recommended mitigation is to set session.upload_progress.enabled=0.

Why it matters for trust and compliance

  • The issue underscores the importance of continuous configuration‑control monitoring and documented mitigation evidence, which map to control‑mapping objectives across frameworks.
  • Enables continuous monitoring of risky PHP configuration changes.
  • Provides auditable evidence of mitigation for compliance reviews.

Who is affected

Web application developers Hosting providers SaaS platforms using PHP

Recommended actions

  1. Audit PHP settings for session.serialize_handler and session.upload_progress.enabled.
  2. Apply the interim mitigation by disabling session.upload_progress.enabled.
  3. Integrate the setting into your baseline controls and enable continuous monitoring.
  4. Document the mitigation in your control‑evidence repository.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.