Use-after-free in PHP - CVE-2026-115560
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to an incomplete fix for #VU156712 (CVE-2026-109619). A remote attacker under certain condition can still bypass implemented user-after-free protections and execute arbitrary code on the system.
As per official PHP advisory:
The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled.
Affected software
How to mitigate CVE-2026-115560
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Security patch will be released in the regular release cycle. As a temporary solution the vendor suggests to set "session.upload_progress.enabled=0" to avoid potential code execution.