Two PHP Advisories in Three Days: What WordPress Site Owners Should Do

On October 21, PHP fixed two critical bugs known as PHP2Shell. On October 23, it published a third, much narrower issue, CVE-2026-115560, and asked administrators to keep one PHP setting turned off until the next regular PHP release. For most WordPress sites the risk is low and the fix is one line. Here’s what changed, what to do, and a correction to our last post.

What’s new on October 23

PHP describes CVE-2026-115560 as an unlikely way to run code on a server, which “can only occur under an unusual combination of configuration and application code.” It needs all of these at once:

• PHP’s session serializer is set to a non-default value (php_binary or php_serialize),
• the application switches it back to php while running, before starting a session, and
• PHP’s session upload progress feature is on, which it is by default.

There is no emergency patch. PHP will fix it in its next regular release and publish a full advisory then. Affected versions and a severity score haven’t been published yet, and we haven’t seen reports of it being exploited.

PHP’s advice until then: set session.upload_progress.enabled=0. If you already did that after October 21, keep it, and there is nothing more to do.

Does this affect WordPress?

WordPress itself doesn’t use PHP sessions, and it doesn’t use session upload progress. Some plugins start PHP sessions, and a rare few change the session serializer. That’s the combination PHP is warning about. You don’t need to audit every plugin: turning the setting off removes the risk for everyone and doesn’t break WordPress.

The one-line fix

1. Add this line to your site’s .user.ini file, in the same folder as wp-config.php on most hosts, or to php.ini:
   session.upload_progress.enabled = Off
2. Or ask your host to turn it off for you.
3. Changes to .user.ini can take up to five minutes to apply.

Then keep PHP itself updated. The October 21 versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12) are still the ones to be on. This setting doesn’t replace them.

A correction to our last post

In our PHP2Shell post we said that turning this same setting off “protected nothing.” That was too strong. PHP’s October 21 advisory listed it as a stopgap for one of the two bugs, for servers that couldn’t update right away. It blocks the known ways in for that bug, but not every variant, and PHP was clear that only updating makes a server safe. We’ve kept the setting off on all our sites since the 21st, and we’re keeping it off now.

The lesson from that post still stands, just more precisely: a setting can narrow the risk, but it isn’t a patch. Patch first. Keep the stopgap while the advisory says to.

What we added to PressBot

Checking a PHP setting by hand on every server is exactly the kind of thing that gets missed. So Site Check, free in every PressBot install, now checks this setting too, in the next PressBot update:

• It tells you whether session upload progress is on, and shows the one-line fix if it is.
• It raises the warning when your server also uses a non-default session serializer, the combination PHP warned about.
• It reads the setting your website actually uses, not just the command line, which can differ.
• In Pro, the weekly Site Check alert on Telegram includes the serious case, once per change.

It sits next to the PHP version check we added after PHP2Shell, which tells you whether your PHP still gets security fixes and whether your server is behind on a security release.

Checklist

1. Make sure your site runs PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. In WordPress: Tools → Site Health → Info → Server.
2. Turn off session upload progress with the line above, or ask your host.
3. Keep it off until PHP’s next regular release says otherwise.
4. Keep a recent backup somewhere other than the server.

If you run PressBot, update when the next version is out and open Site Check. If you don’t, the free plugin is on WordPress.org as GreenScript PressBot.