Affected Systems

PHP installations with non-default session configuration: session.serialize_handler set to php_binary or php_serialize, then switched to php at runtime via ini_set() before session_start(), and session upload progress enabled. Affects a small subset of the ~5.1 million PHP hosts exposed online.

Exploitation Status

No active exploitation reported. Vulnerability requires unusual configuration combination unlikely in practice. No public PoC available. PHP team handling via regular release cycle, not emergency patching.

Business Impact

Risk is limited to systems with specific non-default session handler switching behavior. Most PHP deployments are not vulnerable. Organizations that previously applied mitigation for PHP2Shell (CVE-2026-109618/109619) by disabling session upload progress are already protected. Patch expected in next regular PHP release cycle.

Urgency

🟡 Within a week

Recommended Actions

  • Set session.upload_progress.enabled=0 in php.ini or web server configuration files to disable session upload progress
  • Audit PHP applications to identify any that dynamically change session.serialize_handler at runtime using ini_set()
  • If mitigation was applied for PHP2Shell vulnerabilities on October 20-22, 2026, verify session.upload_progress.enabled=0 is still in place
  • Monitor PHP security advisories for patch release in upcoming regular release cycle
  • Review web application firewall and IDS logs for unusual session-related POST requests targeting PHP applications