The PHP security team has issued an advisory on October 23 warning of a new remote code execution vulnerability identified as CVE-2026-115560, but says it will not be patched until the next release because exploitation requires a rare configuration. The flaw only triggers when an application sets session.serialize_handler to php_binary or php_serialize and then switches it to php at runtime with ini_set() before calling session_start(), while session upload progress remains enabled. As a mitigation, administrators are advised to set session.upload_progress.enabled=0, as recommended on October 21 for the related CVE-2026-109619. The advisory notes that most environments will not meet the required conditions, so the risk is limited. PHP powers roughly 70% of global websites, including WordPress, Drupal, Joomla and Magento, making the guidance relevant for a large share of web operators. 1