[web-php] master: Add information advisory for session upload progress issue

Author: Jakub Zelenka (bukka) Date: 2026-10-23T12:16:47+02:00 Commit: https://github.com/php/web-php/commit/c421fd52760139047199ddbe606e6ddf8bbf3323 Raw diff: https://github.com/php/web-php/commit/c421fd52760139047199ddbe606e6ddf8bbf3323.diff Add information advisory for session upload progress issue Changed paths: A public/archive/entries/2026-10-23-1.xml M public/archive/archive.xml Diff: diff --git a/public/archive/archive.xml b/public/archive/archive.xml index 799c815837..e5b1bb6ab6 100644 --- a/public/archive/archive.xml +++ b/public/archive/archive.xml @@ -9,6 +9,7 @@ <uri>http://php.net/contact</uri> <email>php-webmaster@lists.php.net</email> </author> + <xi:include href="entries/2026-10-23-1.xml"/> <xi:include href="entries/2026-10-21-5.xml"/> <xi:include href="entries/2026-10-21-6.xml"/> <xi:include href="entries/2026-10-21-4.xml"/> diff --git a/public/archive/entries/2026-10-23-1.xml b/public/archive/entries/2026-10-23-1.xml new file mode 100644 index 0000000000..09c595fe75 --- /dev/null +++ b/public/archive/entries/2026-10-23-1.xml @@ -0,0 +1,34 @@ +<?xml version="1.0" encoding="utf-8"?> +<entry xmlns="http://www.w3.org/2005/Atom"> + <title>Informational advisory: Session upload progress</title> + <id>https://www.php.net/archive/2026.php#2026-10-23-1</id> + <published>2026-10-23T10:12:28+00:00</published> + <updated>2026-10-23T10:12:28+00:00</updated> + <link href="https://www.php.net/index.php#2026-10-23-1" rel="alternate" type="text/html"/> + <link href="https://www.php.net/archive/2026.php#2026-10-23-1" rel="via" type="text/html"/> + <category term="frontpage" label="PHP.net frontpage news"/> + <content type="xhtml"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p> + We suggest you set <code>session.upload_progress.enabled=0</code> until the + next regular bugfix release, to fully protect from an unlikely RCE vector. + This setting was already listed as a mitigation in the + <a href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp">GHSA-6wmf-4rv5-p3rp</a> + advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it + then, keep it in place and no further action is needed. + </p> + <p> + The issue can only occur under an unusual combination of configuration and + application code. An application must set + <code>session.serialize_handler</code> to <code>php_binary</code> or + <code>php_serialize</code> in its configuration and then switch it to + <code>php</code> at runtime with <code>ini_set()</code> before calling + <code>session_start()</code>. Session upload progress must also still be + enabled. Applications that never change the serialize handler at runtime can + keep the feature enabled. Since this setup is unlikely in practice, we are + handling it in the regular release cycle and will publish a full advisory for + CVE-2026-115560 with the next release. + </p> + </div> + </content> +</entry>