Keep the two security decisions separate
The PHP Project’s October 23 notice identifies another potential route to remote code execution, tracked as CVE-2026-115560. The project describes the required setup as uncommon and plans to address it through its normal release cycle.
This follows the October 21 emergency updates for two different vulnerabilities. Those fixes and the newer configuration precaution address separate issues. Operators should not interpret the later notice as a reason to postpone installing the earlier security updates.
Which configuration needs attention
According to PHP, the newer issue requires upload-progress tracking to remain enabled while application code changes the session serialization format at runtime. The project recommends disabling session.upload_progress.enabled until the next regular bugfix release. Its notice says applications that never make the runtime format change can retain the feature.
The PHP manual explains that this feature records file-upload progress in session data, before application scripts execute. Disabling it therefore affects a particular progress-reporting mechanism; it should be assessed against the application’s upload workflow.
The reviewed notice does not give a calendar date for the next fix. CGH has not reproduced the vulnerability or evaluated any particular hosting environment.
CGH perspective
A version inventory and a configuration review answer different questions. Ask whoever manages the server to identify the running PHP build, the source of its security updates and whether the application uses the affected session behavior.
After an approved configuration change, check both ordinary file uploads and any progress display. Retain a record of the effective settings and revisit the temporary measure when the vendor releases its fix. A configuration precaution for one issue is not evidence that an entire website is secure.