Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[danami]

Guys there is another unpatched PHP RCE: CVE-2026-115560. Make sure to set `session.upload_progress.enabled=0` in all your PHP.ini files:

https://twitter.com/x/status/2113580383875019242

 

[Mehl]

Guys there is another unpatched PHP RCE: CVE-2026-115560. Make sure to set `session.upload_progress.enabled=0` in all your PHP.ini files:

https://twitter.com/x/status/2113580383875019242

but read the article linked first.

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

only exploitable under very unusual combination of configuration and application code.

 

[Bitpalast]

Guys there is another unpatched PHP RCE: CVE-2026-115560. Make sure to set `session.upload_progress.enabled=0` in all your PHP.ini files:

https://twitter.com/x/status/2113580383875019242

but read the article linked first.

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

only exploitable under very unusual combination of configuration and application code.

"... Since this setup is unlikely in practice, ..."
Really? Hackers will just upload their own script that configures the system the way they want it, then start the attack.

One strategy would be to set

php_admin_flag[session.upload_progress.enabled] = off

in the additional directives, so that the value cannot be changed by the subscription owner via an .ini file. It will end up in the /opt/plesk/php/<version>/etc/php-fpm.d/*.conf file of the domain. But that can be tedious if you have many domains on a server as it needs to be done on a "per domain" basis.

Another solution can be

sed -i 's/;session.upload_progress.enabled = On/session.upload_progress.enabled = O/g' /opt/plesk/php/<version>/etc/php.ini
sed -i 's/;user_ini.filename = ".user.ini"/user_ini.filename = ""/g' /opt/plesk/php/<version>/etc/php.ini
service plesk-php<version>-fpm restart

That will set the variable for all PHP instances using that version while it disables user .ini files altogether. As the session.upload_progress variable cannot be set by ini_set() it will keep an attacker from making the environment fit a malicious purpose.

Opinions on this?

 

[Mehl]

"... Since this setup is unlikely in practice, ..."
Really? Hackers will just upload their own script that configures the system the way they want it, then start the attack.

One strategy would be to set

in the additional directives, so that the value cannot be changed by the subscription owner via an .ini file. It will end up in the /opt/plesk/php/<version>/etc/php-fpm.d/*.conf file of the domain. But that can be tedious if you have many domains on a server as it needs to be done on a "per domain" basis.

Another solution can be

That will set the variable for all PHP instances using that version while it disables user .ini files altogether. As the session.upload_progress variable cannot be set by ini_set() it will keep an attacker from making the environment fit a malicious purpose.

Opinions on this?

That must be authorized and authenticated hackers though ....

 

[Bitpalast]

That must be authorized hackers though ....

Just think about all the domains that are compromised through successful hacking attempts already. I am not speaking about new attempts, just use the existing infections. There are tons of Joomla and Wordpress installations that are malware infected, and these already have the possibility to upload scripts into the subscription freely.

 

[Mehl]

Well, I guess then this vulnerability is your smallest problem. If they are already in the system, why would the hackers want another way to break in?