An Incident Response Checklist for CVE-2026-115560
CVE-2026-115560 does not justify a blind application rollback. It does justify a short, evidence-driven response. The PHP notice describes a narrow remote code execution path tied to a session handler transition, and the current temporary control is to disable session upload progress until the next regular bugfix release.
1. Scope the application
List every PHP application and the SAPI that serves it. Record the PHP version, package source, image digest, FPM pool or Apache instance, and owner. Identify applications that expose upload functionality or start sessions from remote requests. This is an inventory step, not a vulnerability finding.
2. Verify the starting configuration
Check the effective session.serialize_handler value in the web runtime. Look for php_binary or php_serialize. Check session.upload_progress.enabled at the same time. Include global files, pool settings, virtual hosts, .user.ini, and permitted .htaccess overrides. Do not use the CLI result as a substitute for the web process.
3. Review the runtime sequence
Search application code and framework boot paths for ini_set() calls that set the handler to php before session_start(). Confirm the order with source review or controlled tracing. The issue requires the initial handler family, the runtime switch, and active upload progress. If any one is absent, record why and keep the evidence.
4. Apply the temporary control
Set session.upload_progress.enabled=0 where applications cannot override it. Use administrative PHP-FPM or Apache settings as appropriate. Audit local files that could restore the value, and restart or replace all workers. Do not treat a configuration reload as proof that old workers have exited.
5. Validate the result
Check the effective setting through a controlled web request. Test a normal upload, the largest expected upload, and the progress display. Review logs for session warnings without logging session contents. If native progress is required, record the exception, owner, compensating control, and review date.
6. Preserve the evidence
Store the application identifier, environment, PHP version, effective settings, code path, test time, worker restart method, and reviewer. Link the record to the official PHP notice. Mark the affected-version matrix and root-cause details as pending until the full advisory is available.
Exposure context
The selected ZoomEye Search was app="PHP". It returned 111,111,696 product fingerprint matches on November 6, 2026. That is a broad PHP population count, not a count of installations that meet the configuration conditions for CVE-2026-115560. The separate Filter vul.cve="CVE-2026-115560" returned zero. The Search count is therefore the Exposure value, but it must not be read as confirmed vulnerable assets.
The Search link is ZoomEye.
7. Close only after the patch review
Watch for the next regular PHP bugfix release and the full advisory. Read the fixed version and affected-version statement before updating. Deploy through the normal package and image process, replace workers, and repeat the functional tests. Restore upload progress only through a separate approved change. The response is complete when the evidence shows the intended runtime state, not when a ticket is marked closed.
