Security advisory · no PHP fix yet
CVE-2026-115560 on Windows Server: switch off PHP upload progress until PHP fixes it
On 23 October 2026, two days after the PHP2Shell releases, the PHP project warned of another flaw in the same corner of PHP: session upload progress, the code that reports how far a file upload has got so a page can draw a progress bar. The data it handles comes straight from whoever is uploading. There is no fixed PHP yet, and patching to the PHP2Shell releases does not help. The advice is to turn the feature off. This page shows how to do that on IIS, the per-folder catch most guides miss, and how ServerMaid keeps it off for you.
Kept off automatically from ServerMaid 1.3.49. Server setup from £99 £49.50 per server for twelve months. 30-day money-back promise.
What CVE-2026-115560 is, and how worried to be
When a form uploads a file, PHP can record the upload's progress in the visitor's session as it arrives, so another request can ask “how far has it got?” and draw a bar. That feature, session.upload_progress, is on by default in PHP. CVE-2026-115560 is a flaw in how that progress data is handled. Because the data is written into the session from the upload itself, the person controlling it is whoever is uploading, not the website.
The PHP project rates it unlikely to affect most websites: the reported trigger needs an application that sets one session serialisation format in its configuration and switches to another at run time. That is unusual, but “unusual” is not the same as “nobody”, and you rarely know every setting every plugin on a server has chosen.
What matters for a server owner:
- There is no fixed PHP release yet. PHP expects to fix it in a routine release. Updating to the PHP2Shell releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) does not close it.
- The advice is to switch the feature off:
session.upload_progress.enabled = 0. This was already part of the interim advice for PHP2Shell, and it costs almost nothing. - php-cgi on IIS is in scope, like every way of running PHP that serves web requests.
Sources: the PHP project’s announcements and the reporting that followed the advisory. Details may change as PHP publishes more; we will update this page.
Turning it off on IIS by hand
- Find every php.ini that is actually used. In IIS Manager, open the server node, then FastCGI Settings. Each php-cgi.exe entry has an environment variable
PHPRCnaming the folder its php.ini lives in; with no PHPRC, it is the php.ini beside php-cgi.exe. Servers that have been upgraded over the years often have two or three. - Set it in each one. Add or change the line
session.upload_progress.enabled = 0. If the setting appears more than once, the last one wins, so put it at the end. - Let PHP pick it up. IIS recycles the PHP workers when php.ini changes if FastCGI is set to monitor it; if you are not sure, recycle the websites’ application pools.
- Check the value PHP really uses, not the file: in each PHP folder run
php.exe -c "path\to\php.ini" -r "var_dump(ini_get('session.upload_progress.enabled'));". You want"0". - Now the catch: check every website for
.user.ini. This setting can be changed per folder. A.user.inifile anywhere in a website, often shipped by a plugin or carried over from an old host, can switch upload progress back on for that folder and everything below it, whatever php.ini says. Search each website for files named.user.iniand remove or comment out any line that setssession.upload_progress.enabledto 1 or On. - Remember to look again. Every new plugin, theme or uploaded site can bring its own
.user.ini. And when PHP finally ships the fix, it will need installing too.
Will anything break? Only a page that draws a live upload progress bar using PHP’s own session upload progress loses the bar; the upload itself still works. Most upload forms, WordPress media uploads included, do not use this PHP feature.
The ServerMaid way
Five reasons a ServerMaid server already has it off, and keeps it off
ServerMaid is the automated Windows web server engineer. It wrote your php.ini, so it knows what each setting should be, and from version 1.3.49 it puts this one back by itself whenever it moves.
It was already off
Every php.ini ServerMaid has written since 1.3.47 (22 October 2026) sets session.upload_progress.enabled = 0, on every PHP line, as part of the PHP2Shell hardening. Servers built or repaired since then were never exposed through php.ini.
It puts it back every hour
The hourly scan re-applies the PHP hardening if anything has changed it, on every PHP line ServerMaid installed, with nobody logged on. A php.ini edited by hand or by an installer is back to safe within the hour.
It asks PHP, not the file
A health check asks each PHP that IIS runs for the value it really uses. If upload progress is on anywhere, the Dashboard shows a Critical alert naming the PHP and the php.ini, with a Fix button.
It closes the .user.ini loophole
ServerMaid looks through every website it manages for .user.ini files that switch upload progress back on, and turns that one line off, leaving the rest of the file alone and keeping a copy so it can be undone.
It will install the fix when it lands
When PHP ships the release that fixes CVE-2026-115560, the same hourly scan installs it on every PHP line ServerMaid manages, restarts the PHP workers and clears the alert, exactly as it did for PHP2Shell.
This arrives with ServerMaid 1.3.49 and works on every licence that is in date. See also PHP2Shell on IIS, the flaws fixed two days earlier.
Questions about CVE-2026-115560 on Windows Server
What is CVE-2026-115560?
A flaw in the part of PHP that tracks file uploads as they arrive (session upload progress, the data behind upload progress bars). PHP published an advisory on 23 October 2026, two days after the PHP2Shell releases, and rates it unlikely to affect most websites because it needs an unusual combination of session settings.
Is there a fixed PHP version?
Not yet. The releases that fixed PHP2Shell do not fix this one. PHP expects to fix it in a routine release and advises turning session upload progress off until then.
How do I turn session upload progress off on IIS?
Set session.upload_progress.enabled = 0 in the php.ini each PHP on the server uses (the folder in the FastCGI application’s PHPRC setting, or the PHP folder itself). IIS recycles the PHP workers when php.ini changes. Then check every website for a .user.ini file that turns it back on, because the setting can be changed per folder.
Will turning it off break my website?
Only a page that shows a live progress bar while a file uploads, using PHP’s own session upload progress, loses the bar. The upload itself still works. Most upload forms, WordPress media uploads included, do not use this PHP feature.
Does ServerMaid protect against CVE-2026-115560?
Yes. Every php.ini ServerMaid writes has had session upload progress off since 1.3.47. From 1.3.49 the hourly scan also re-applies it if it drifts, asks each PHP for the value it really uses, and turns it off in any website .user.ini that switches it back on, with nobody logged on.
My server already has ServerMaid. What do I need to do?
Install ServerMaid 1.3.49 when the update banner offers it. From then on the hourly scan keeps the setting off by itself. On an older version, open Health & Security (or Repair & Security) and press Fix on the php.ini row.
New PHP flaws keep coming. Be the server that handles them by itself.
ServerMaid, the automated Windows web server engineer. Single servers from £99 £49.50 for twelve months; Agency licences for 3, 6 or 12 servers.