PHP fixed two critical flaws that could let attackers run code remotely and, on October 23, disclosed a third, narrower risk, advising affected applications to turn off session upload progress until a routine fix arrives.
The two patched flaws, CVE-2026-109618 and CVE-2026-109619, could let attackers run code on PHP systems handling web requests without logging in. The project rated both flaws critical. On October 21, fixes were released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP urged users to update and advised people using older versions to check for fixes provided by their software vendors. The newly disclosed issue, CVE-2026-115560, involves session upload progress and is considered unlikely because it requires an unusual combination of application settings and behavior while the program is running. Specifically, an application must use a non-default format for session data and change to another format while running, before starting a session.
It must also leave upload-progress tracking enabled. PHP recommends setting `session.upload_progress.enabled=0`. Users who already applied that setting to reduce the risk from the earlier flaws do not need to take any further action.
The project says it will address the third issue in its regular release schedule rather than issue an emergency fix. It plans to publish a full security notice with the next release.