Session Lifecycle Review for CVE-2026-115560 in PHP Applications
CVE-2026-115560 sits at the boundary between configuration and request processing. PHP's notice says the session serialization handler must begin in one family and then change before the session starts. A lifecycle review is more useful than a list of files because the ordering is part of the condition.
Configuration phase
The application's selected INI configuration must set session.serialize_handler to php_binary or php_serialize. Session upload progress must be enabled. These values may come from a global file, a pool, a virtual host, or an allowed per-directory override. They must be confirmed in the web process that handles requests.
The advisory does not say that every application using one of those handlers is vulnerable. It adds the runtime switch and the session start to the sequence. That means the initial value alone is not enough to close or open an investigation.
Request phase
Application code must call ini_set() to set session.serialize_handler to php before calling session_start(). The code may live in a framework bootstrap, a middleware component, a compatibility shim, or a custom request initializer. The correct review follows the call order for each request path that can start a session.
If session_start() has already run, the advisory sequence is not present in that request. If the runtime sets a different handler, the sequence is not present. If upload progress is disabled, the feature condition is absent. These distinctions should be recorded rather than collapsed into a generic PHP version finding.
Why the session boundary matters
Session upload progress stores state associated with an upload in the session workflow. The advisory links that feature to the handler transition and describes the result as an unlikely RCE vector. It does not publish the full internal cause, so defenders should not invent one. The safe conclusion is that a specific feature and a specific ordering create a path the PHP project considers worth mitigating.
Applications that never change the handler at runtime can keep upload progress enabled, according to PHP. That does not make configuration review unnecessary. It narrows the review to code that can perform the runtime change.
Review method
Start with an application map. For each entry point that may start a session, record the initial handler, any runtime changes, the session start, and the upload progress setting. Use source review for static code and request tracing for dynamic frameworks. Confirm the effective configuration in a staging or controlled production request. Keep sensitive session values out of logs.
Exposure context
The selected ZoomEye Search was app="PHP". It returned 111,111,696 product fingerprint matches on November 6, 2026. That is a broad PHP population count, not a count of installations that meet the configuration conditions for CVE-2026-115560. The separate Filter vul.cve="CVE-2026-115560" returned zero. The Search count is therefore the Exposure value, but it must not be read as confirmed vulnerable assets.
The Search link is ZoomEye.
Remediation
Disable session.upload_progress.enabled until the next regular PHP bugfix release. Enforce it outside application control, audit overrides, and restart workers. If the handler switch exists but upload progress is not needed, the mitigation should have limited functional impact. If progress is required, document the exception and prepare a tested replacement. The promised full advisory should be reviewed for version and root-cause details before the team treats the patch as complete.
