PHP-FPM and Apache Response Planning for CVE-2026-115560
The same PHP vulnerability can require different operational steps under PHP-FPM, Apache with an embedded PHP module, containers, and shared hosting. CVE-2026-115560 is no exception. The temporary control is simple, but it must reach the correct worker, survive application overrides, and remain visible after deployment.
PHP's notice describes a narrow RCE condition involving session upload progress. The application must start with php_binary or php_serialize, switch the handler to php with ini_set() before session_start(), and leave upload progress enabled. PHP recommends setting session.upload_progress.enabled=0 until the next regular bugfix release.
PHP-FPM
Place the setting in the pool configuration that serves the application. Use an administrative value so local application settings cannot restore it. Check every pool used by the same application, including background or administrative pools that can process uploads. After the change, restart the FPM service or replace the process generation and verify that old workers have exited.
Confirm the effective value from a request handled by that pool. A web page that calls phpinfo() is suitable for a short, controlled check if it is protected and removed immediately. Do not use session data or user-uploaded content in the diagnostic page.
Apache with PHP
Apply the setting at the virtual-host or directory level that controls the PHP execution context. Check whether .htaccess or another local configuration can override it. If PHP runs through FPM instead of an embedded module, use the corresponding pool configuration. Record which mode is active before changing directives.
Restart the web server or replace its workers according to the deployment model. A graceful reload may not be enough if old workers remain available. Verify both the PHP module or pool and the effective setting after the restart.
Containers and shared hosting
In a container, change the image, configuration mount, or startup process that creates the PHP configuration. Replacing a file in a running container creates drift and may disappear on restart. Deploy a new container, verify the setting, and then remove the old one. In shared hosting, confirm that the host panel applies the setting to the intended PHP version, pool, and document root.
Validation and rollback
Test a normal upload, the largest supported upload, and the application action that displays progress. Capture the response and relevant logs without recording file contents. If the application depends on native progress data, prepare a rollback that restores functionality only with an explicit risk decision and a documented compensating control.
Exposure context
The selected ZoomEye Search was app="PHP". It returned 111,111,696 product fingerprint matches on November 6, 2026. That is a broad PHP population count, not a count of installations that meet the configuration conditions for CVE-2026-115560. The separate Filter vul.cve="CVE-2026-115560" returned zero. The Search count is therefore the Exposure value, but it must not be read as confirmed vulnerable assets.
The Search link is ZoomEye.
Next release
Keep the mitigation until the next regular PHP bugfix release and the full advisory are both reviewed. Then update the package, replace workers, and retest the same paths. The deployment record should show the temporary setting, the future fixed version, and the owner who approved any change to upload progress behavior.
