Daily · Article 01 · 4 min read · Series 3 episode
- Security
PHP adds upload-progress checks after its patches
October 23 official announcements · originals rechecked October 24, 15:52 JST
Summary
PHP issued additional guidance on October 23 for a specific combination of session settings and code. Server operators should ask their host about progress tracking and runtime format changes, and keep existing tracking disablement until the next regular fix.
Key facts
- Who should read this: people operating server-side PHP. Remote code execution (RCE) means an attacker can make a server run unwanted code; accessible permissions and data determine the scope for theft or site alteration.
- What to do: ask the host, “Is PHP upload-progress tracking disabled for this app, and does its code switch session formats at runtime?” Keep an existing disablement in place.
- Patch status: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix the earlier two flaws. The October 23 notice concerns a particular configuration/code combination; it announces no new fixed version number or release date.
- At 19:12:28 JST on October 23, PHP recommended
session.upload_progress.enabled=0until the next regular bugfix release. The additional identifier isCVE-2026-115560, with a full advisory planned for that release. PHP also says apps that never change the format at runtime can keep the feature enabled.Official additional notice
1. Sending the photo and recording its progress
Think of the progress bar while a photo uploads. The file travels to the server; PHP’s progress tracker records transfer status in session data. An app using that feature can read the record to display progress.Feature documentation
A session keeps information on the server for use across requests. For example, an app asking again about progress can find the previously recorded status. session.serialize_handler selects the format used to store and read that information.Session settings
- Send a photo to the serverThe file transfer
- Record transfer status in session dataPHP progress tracking
- The app reads the record to show progressA display that uses that feature
Disabling progress tracking stops its status records. Test the upload and the app’s progress display separately.
The cat asks Q&A
The researcherWhy record progress on the server too?
Pocket NotebookIt lets an app ask again about the server’s transfer state. Disabling this tracker is separate from blocking the file transfer, so test uploading and the progress display separately afterward.
2. Look for the three conditions together
The stated combination starts with php_binary or php_serialize configured as the format. The app then switches it to php at runtime with ini_set() before calling session_start(), while progress tracking remains enabled.
ini_set() changes some settings during execution; session_start() starts a session or reads existing data to resume one. The effective setting and the app’s actions before it reads the session both matter.Setting function · Session function
- Starting configuration: php_binary or php_serialize
- +App switches to php with ini_set(), then calls session_start()
- +PHP upload-progress tracking is also enabled
Check the combination; keep progress tracking disabled if already disabled.
The cat asks Q&A
- The researcher
Does the host check settings while a developer checks code?
Pocket NotebookThe host can check effective web PHP settings, and the app or plugin maintainer can check for changes before session start. Together, those findings establish whether the stated combination applies.
3. Three sites displaying the same version
These are fictional Moon Hosting sites, not actual diagnoses. All run PHP 8.4.27, but their settings and code lead to different findings against this additional notice.
A · Keep the format
- Starting format
- php
- Runtime change
- No change
- Progress tracking
- On
- Meaning for this path
- Does not meet the stated format-change condition
B · Change before starting
- Starting format
- php_serialize
- Runtime change
- Switch to php → start session
- Progress tracking
- On
- Meaning for this path
- Meets the described combination; action is needed
C · Disable progress tracking
- Starting format
- php_serialize
- Runtime change
- Switch to php → start session
- Progress tracking
- Off
- Meaning for this path
- Has the recommended mitigation for this path
The cat asks Q&A
- The researcher
Why do A and B need different responses on the same version?
Pocket NotebookThe version identifies installed PHP; the cards describe how the app configures and uses it. Keep the earlier security update while checking these additional conditions separately.
4. Questions for the host and tests after a change
Ask: “What are this app’s effective web PHP value for session.upload_progress.enabled and its starting session format? Does the app change that format before starting the session? What are your plans for this recommendation and the follow-up fix?”
This setting cannot be disabled with one ini_set() line in the app. PHP lists it as INI_PERDIR; review the effective configuration location with the provider. The earlier security notice specifies php.ini, FPM-pool or server configuration applied before request parsing and restarting every worker. It explicitly says not to rely on ini_set() or FPM .user.ini.Configuration modes · PHP application instructions
After a change, test uploads, progress displays and login/session functions separately. If a PHP version change is needed, first review backups and theme/plugin compatibility.WordPress operations guide
The cat asks Q&A
- The researcher
What evidence should I keep after the host says it is disabled?
Pocket NotebookKeep the value effective for this app’s web requests, its configuration location and application time. Add the functional test results and next-package plan so the next step is clear.
5. What Cloudways closed
Cloudways, a provider that supplies and manages hosting environments, marked the existing PHP incident resolved at 21:38:45 JST on October 23. Its closing sentence supplies no new-CVE or individual app configuration findings.Cloudways incident
The previously reported web PHP 8.4.27 observation is from 14:03 JST on October 22. This editorial revision did not re-inspect or change that app’s settings or code; whether the additional conditions apply remains unverified.
The cat asks Q&A
- The researcher
How do I keep the host’s closure and my app’s result straight?
Pocket NotebookKeep the provider’s closure time with the previous rollout record, and its answer about these session conditions with the app-specific check. Do not relabel an old version reading as a new settings inspection.
To close
Carry the response into the next release
Keep the security update and any progress-tracking disablement already applied. For the next regular release, check both whether it fixes CVE-2026-115560 and whether the provider has applied it to web PHP.
Sources
- Official additional noticephp.net
- Feature documentationphp.net
- Session settingsphp.net
- Setting functionphp.net
- Session functionphp.net
- Configuration modesphp.net
- PHP application instructionsphp.net
- WordPress operations guidewordpress.org
- Cloudways incidentstatus.cloudways.com