At Webuzo, server security and stability are our top priorities. Following the latest security advisory published by the PHP development team on October 23, 2026, we have implemented recommended mitigation steps across all managed PHP versions on Webuzo servers.
What Changed?
Following the official PHP Advisory (2026-10-23-1), an unpatched Remote Code Execution (RCE) vector (tracked as CVE-2026-115560) was identified involving runtime manipulations of the session serialize handler when upload progress monitoring is active.
To safeguard all hosted websites and applications from potential exploitation, Webuzo has proactively disabled session.upload_progress.enabled across all available PHP versions by default.
Specifically, the setting has been configured assession.upload_progress.enabled = 0
We have added an INI file in the update via the php-common package in Webuzo :
/usr/local/apps/phpXX/etc/php.d/CVE-2026-109619.ini
Do Webuzo Users Need to Take Any Action ?
Your servers will update in 24 hours.
Our automated server updates and core configuration scripts have already applied this change across your PHP environments.
This mitigation ensures that your servers remain completely protected against CVE-2026-115560 while waiting for official upstream bugfix releases from the PHP core development team.
To update immediately run :
/usr/local/emps/bin/php /usr/local/webuzo/cron.php debug=2
Impact on Web Applications
General Website Functionality: For the vast majority of web applications (such as WordPress, Laravel, Joomla, standard e-commerce stores, and custom applications), this configuration change will have no impact.
File Upload Progress Bars: The only feature affected by this setting is the server-side monitoring of HTML/PHP file upload progress bars. If your application relies on
$_SESSIONupload progress arrays, that specific tracking will be temporarily disabled until the upstream PHP patch is deployed. Modern web applications generally rely on browser-native APIs (XMLHttpRequest/ JavaScriptfetchprogress listeners) rather than server-side PHP session progress tracking.
Security Recommendation: We strongly advise keeping
session.upload_progress.enabled = 0active on all production environments until the PHP development team releases the official patch versions.
Looking Ahead
The PHP project team is preparing official upstream security patches, which will land in the next scheduled release cycle. Once these patched PHP packages are released and verified, Webuzo will update the core PHP packages accordingly across our platform.
If you have any questions or require assistance with your PHP configurations, feel free to reach out to our Webuzo Support Team.
Regards,
The Webuzo Team