PHP session.upload_progress pre-auth RCE via runtime serialize_handler mismatch

CVE-2026-115560 is a PHP session upload progress vulnerability disclosed on 2026-10-23 as an informational advisory by the PHP project. It arises when an application (a) configures session.serialize_handler to php_binary or php_serialize in its .ini/.htaccess/.user.ini and then (b) calls ini_set('session.serialize_handler', 'php') at runtime before session_start(), while session.upload_progress.enabled remains On (the default). Under these conditions, the upload-progress callback writes session data using the config-level serializer, but session_start() reads it back with the runtime-switched php handler. The php handler treats | as a key-value delimiter, while php_serialize and php_binary do not — an attacker-controlled upload filename containing | followed by a serialized PHP object causes the php handler to split at the wrong boundary and call unserialize() on attacker-supplied data. The resulting object injection fires __destruct() / __wakeup(), enabling POP-chain-to-RCE. Affected: all PHP versions from 5.4.0 (when session.upload_progress was introduced) through current supported branches (8.2.x, 8.3.x, 8.4.x, 8.5.x). No patch is released yet; PHP will include the fix in the next regular bugfix release.

There is no vendor CVSS score for this CVE. PHP itself labels it an *unlikely RCE vector* and is handling it through the regular release cycle — not the emergency process used for the related php2shell CVEs (CVE-2026-109618/109619, CVSS 9.2). That framing is honest: the configuration pattern — deliberately switching serialize_handler at runtime before session_start() — is a code anti-pattern that no major framework (Laravel, Symfony, WordPress, Drupal, Magento) performs by default. PHP bug #71101 documented this handler-mismatch risk back in 2015 and was closed as a *documentation problem*. The practical population of vulnerable deployments is vanishingly small. However, the attack is pre-authentication (upload progress fires in SAPI before application code), so where the conditions *do* exist, exploitation is straightforward.

Sources.

1. PHP Informational Advisory (php.webmaster mailing list)
2. GHSA-6wmf-4rv5-p3rp — PHP RCE via stale global state (sibling CVE-2026-109619)
3. PHP Bug #71101 — serialize_handler must not be switched for existing sessions (2015)
4. Sansec — PHP2Shell: PHP RCE Research
5. Wiz — PHP2Shell: AI uncovers critical RCE vulnerabilities
6. CERT-EU Security Advisory 2026-018 — Critical Vulnerabilities in PHP
7. UW IT — Critical PHP vulnerabilities (Oct 2026)

Run this script on each PHP application host as root (or any user with read access to php.ini and the webroot). Invoke with: sudo bash check_cve_2026_115560.sh /var/www/html where the argument is the path to your PHP application code. The script checks (1) whether session.upload_progress is enabled, (2) whether any PHP files perform a runtime serialize_handler switch, and outputs VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# check_cve_2026_115560.sh — CVE-2026-115560 exposure checker
# Usage: bash check_cve_2026_115560.sh [/path/to/webroot]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

WEBROOT="${1:-/var/www/html}"
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'

# Step 1: Check if PHP is installed
if ! command -v php &>/dev/null; then
  echo -e "${YELLOW}[UNKNOWN]${NC} PHP is not installed on this host."
  exit 2
fi

PHP_VERSION=$(php -r 'echo PHP_VERSION;' 2>/dev/null || echo "unknown")
echo "[*] PHP version: $PHP_VERSION"

# Step 2: Check session.upload_progress.enabled
UPLOAD_PROGRESS=$(php -r 'echo ini_get("session.upload_progress.enabled") ? "1" : "0";' 2>/dev/null || echo "unknown")

if [ "$UPLOAD_PROGRESS" = "0" ]; then
  echo -e "${GREEN}[PATCHED]${NC} session.upload_progress.enabled is Off — CVE-2026-115560 is fully mitigated."
  exit 0
fi

if [ "$UPLOAD_PROGRESS" = "unknown" ]; then
  echo -e "${YELLOW}[UNKNOWN]${NC} Could not determine session.upload_progress.enabled setting."
  exit 2
fi

echo "[!] session.upload_progress.enabled is On (default)."

# Step 3: Scan webroot for runtime serialize_handler switching
if [ ! -d "$WEBROOT" ]; then
  echo -e "${YELLOW}[UNKNOWN]${NC} Webroot '$WEBROOT' does not exist. Cannot scan for handler switching."
  echo "    session.upload_progress.enabled is On — apply mitigation if handler switching exists in your code."
  exit 2
fi

echo "[*] Scanning $WEBROOT for ini_set('session.serialize_handler',...) calls..."

MATCHES=$(grep -rlnE "ini_set\s*\(\s*['\"]session\.serialize_handler['\"]" "$WEBROOT" --include='*.php' 2>/dev/null || true)

if [ -z "$MATCHES" ]; then
  echo -e "${GREEN}[PATCHED]${NC} No runtime serialize_handler switching found in $WEBROOT."
  echo "    session.upload_progress.enabled is On, but the app does not switch handlers."
  echo "    CVE-2026-115560 preconditions are NOT met."
  exit 0
fi

echo -e "${RED}[VULNERABLE]${NC} Runtime serialize_handler switching detected AND session.upload_progress.enabled is On."
echo "    Matching files:"
echo "$MATCHES" | while read -r f; do
  LINE=$(grep -nE "ini_set\s*\(\s*['\"]session\.serialize_handler['\"]" "$f" | head -3)
  echo "      $f: $LINE"
done
echo ""
echo "    REMEDIATION: Set session.upload_progress.enabled=Off in php.ini and restart PHP-FPM,"
echo "    or refactor the application to use a consistent serialize_handler."
exit 1