Informational advisory: Session upload progress
Critical · CVSS 9.2 (vendor) · fetched 2026-10-23
We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed. The issue can only occur under an unusual combination of configuration and application code.
Remediation
Update PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches below 8.2 have no fixed release — upgrade the branch or take the site offline.
Affected PHP branches
PHP 8.2 → fixed in 8.2.35, PHP 8.3 → fixed in 8.3.36, PHP 8.4 → fixed in 8.4.27, PHP 8.5 → fixed in 8.5.12, PHP <8.2 → end-of-life — no fixed release; branch upgrade required
Source: PHP.net News · retrieved 2026-10-23T22:20:15-04:00 · https://www.php.net/index.php#2026-10-23-1