Security
PHP advises disabling session upload progress
PHP has advised administrators to disable session upload progress as a precaution against CVE-2026-115560, an unlikely remote-code-execution vector awaiting a full advisory.
The PHP Project published the informational advisory on 23 October 2026. It concerns PHP's session upload progress feature, controlled by session.upload_progress.enabled, rather than a Joomla extension. PHP has not yet published an affected-version list, CVSS score or complete technical description. The issue is expected to be fixed in the next regular PHP bugfix release, but no fixed version number is available yet.
PHP describes the vulnerability as an unlikely RCE vector requiring an unusual combination of application and session-serialization settings. The project is treating it through the normal release cycle, not as an emergency update. mySites.guru published the research and notes that stock Joomla and WordPress installations do not use the configuration required for the issue to be reachable.
Administrators should set session.upload_progress.enabled=0 in an applicable PHP configuration file, PHP-FPM pool configuration, .user.ini or, where supported, .htaccess. The directive cannot be changed with ini_set(). Anyone who already applied this mitigation for CVE-2026-109619 should leave it in place. This setting does not replace updating PHP for the separate critical flaws fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Originally reported by mySites.guru.