Information for Website Owners

This article is intended for technically experienced users and website developers.

If you are unsure whether your website is affected by this vulnerability and are unable to have your website developer perform the necessary checks, please contact Webvault support via email or call 1300 139 927 to arrange a site security review for CVE-2026-115560.

Overview

On 23 October 2026, the PHP development team published a security advisory concerning CVE-2026-115560, a potential security vulnerability involving PHP's session handling and file upload progress functionality.

This advisory follows two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, announced on 21 October 2026.

Webvault has already deployed the security updates addressing the two earlier critical vulnerabilities across its cPanel and CloudLinux hosting platforms which you can read about here:

Web Hosting PHP Security Updates October 2026

The additional issue, CVE-2026-115560, involves a specific combination of PHP settings and application code. The PHP development team has indicated that this combination is uncommon and that a further software update is planned.

Most standard WordPress installations are unlikely to be affected. However, developers maintaining customised WordPress websites or other PHP applications may wish to perform the following checks.

1. Understanding the vulnerability

PHP uses sessions to remember information about website visitors, such as login status, shopping carts and other temporary data.

CVE-2026-115560 involves an unusual situation where a website changes how PHP stores session information while processing a request.

For a website to be affected, all three conditions must be present:

1. A non-standard session configuration: The website initially uses a PHP session setting called session.serialize_handler, configured as either php_binary or php_serialize.

2. A change made by the application: The website's PHP code changes that setting to php using ini_set() before starting the session with session_start().

3. PHP upload progress is enabled: The setting session.upload_progress.enabled remains enabled.

If these conditions are not all present, the website does not meet the vulnerable configuration described in the PHP advisory.

Important: A website is not vulnerable simply because it uses PHP sessions, accepts file uploads or has an upload form.

2. Checking your website's PHP configuration

If your website is hosted on Webvault's cPanel hosting platform, you can begin by reviewing its PHP settings.

Step 1 – Open your PHP settings

1. Log in to your website's cPanel account.

2. Locate the Software section.

3. Open MultiPHP INI Editor, or Select PHP Version → Options, depending on your hosting configuration.

4. Select the domain or website you wish to review.

The exact settings available will depend on your website's PHP configuration.

Step 2 – Check the session settings

Look for the following PHP settings:

What do the results mean?

• Session handler is php: This is the normal PHP setting. The unusual starting configuration described in the advisory is not present.

• Session handler is php_binary or php_serialize: Further checking of the website's application code is recommended.

• Upload progress is enabled: This alone does not indicate a vulnerability.

• Upload progress is disabled: This is the recommended mitigation, provided the setting is applied before PHP processes the request.

Note: cPanel may not display every PHP setting or configuration override. The values shown in its interface may not represent the complete configuration used by your website.

If you cannot locate these settings or are uncertain how they are applied, Webvault Support can assist with checking the effective PHP configuration.

3. Checking WordPress plugins, themes and custom PHP code

The next step is to determine whether your website changes PHP's session configuration while running.

For most standard WordPress websites, this behaviour would be unusual.

However, custom PHP applications, specialised plugins and older website components may use their own session-handling methods.

What should developers look for?

Using your preferred code editor, search the website's PHP files for:

session.serialize_handler

In particular, look for code that changes the setting using ini_set().

For example:

ini_set('session.serialize_handler', 'php');

Finding this code does not automatically mean the website is vulnerable.

The issue only arises when the application starts with one of the two alternative session formats and then changes to php before calling session_start(), while upload progress remains enabled.

Where should I check?

For WordPress websites, review:

• Plugins: Particularly custom-developed or older plugins.

• Themes: Especially custom themes containing additional PHP functionality.

• Custom PHP code: Any independently developed website features or integrations.

• Third-party libraries: Additional PHP components included with plugins or custom applications.

Developers can use their code editor's Find in Files feature to search the complete website codebase.

If no code changes the PHP session handler during execution, the website does not meet the particular conditions described in the advisory.

A simple text search is a useful first check, although more complex custom applications may require additional review.

4. What if my website might be affected?

If your website appears to use the configuration described above, there are two approaches to addressing the issue.

Option 1 – Review the website's PHP code

Where possible, the preferred approach is to correct the application so that it uses a consistent PHP session configuration.

If a plugin or custom application unnecessarily changes the session handler, your developer should review that behaviour and determine whether the change can be safely removed.

Always back up your website and test application functionality before making changes to PHP code or configuration.

Option 2 – Disable PHP session upload progress

The PHP development team recommends temporarily disabling the following setting:

session.upload_progress.enabled = 0

This disables PHP's built-in session upload progress tracking feature.

It does not disable ordinary website file uploads, although applications that specifically use PHP's built-in upload progress tracking may require testing.

Important: This security setting must take effect before PHP processes the incoming request.

Changing the setting inside a WordPress plugin or using ini_set() is not an appropriate mitigation. Changes made through .user.ini or other website-level configuration files should not be assumed to provide protection without verification.

Webvault Support can assist developers with applying and verifying this setting at the appropriate hosting configuration level.

We recommend against making unnecessary changes to websites that do not use the affected configuration.

5. Checking your website after remediation

After making any PHP or website configuration changes, developers should confirm that the website continues functioning correctly.

In particular, check:

• Website login and logout functionality.

• Contact and enquiry forms.

• File uploads and document attachments.

• Shopping carts and checkout processes, where applicable.

• Any custom applications that depend on PHP sessions.

If PHP session upload progress has been disabled, also check any custom file upload progress indicators.

Webvault can assist with post-remediation security checks to help verify that the required hosting configuration changes have been applied correctly.

6. Do standard WordPress websites need changes?

For websites running a standard WordPress installation with maintained plugins and themes, the configuration involved in CVE-2026-115560 is unlikely to be present.

The PHP development team specifically identifies applications that change their session handler at runtime as the relevant concern.

There is no general recommendation to disable WordPress functionality, remove file upload features or make extensive website changes solely because of this advisory.

Nevertheless, developers should continue maintaining WordPress, plugins and themes, and ensure websites are running supported PHP versions wherever possible.

Further technical information

Security advisory: CVE-2026-115560
Published: 23 October 2026
Affected component: PHP session upload progress
Current recommendation: Review uncommon session configurations and disable PHP session upload progress where appropriate until the relevant PHP security fix becomes available.

The PHP development team intends to address this issue in its next regular bugfix release.

Webvault will continue monitoring updates from PHP, cPanel and CloudLinux and applying applicable hosting platform security fixes as they become available.

Official reference: PHP Security Advisory – Session Upload Progress (23 October 2026)