psf-php-session-audit(8)
PHP session audit for the CVE-2026-115560 preconditions (v1)
If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation
Read-only. Changes nothing; root is optional but sees more.
On 23 Oct 2026 PHP announced CVE-2026-115560: remote code execution through
session upload progress when three things line up:
1. session.serialize_handler is php_binary or php_serialize in config,
2. application code switches it to "php" at runtime before session_start(),
3. session.upload_progress.enabled is still on.
The fix ships in the next regular PHP release. Until then turning upload
progress off (php2shell-mitigate.sh does) closes it. This script tells you
whether the other two conditions exist on this server, so you know whether
you were exposed and whether anything else depends on the switch:
* the configured handler and upload-progress setting for every PHP-FPM
version and pool, and for Apache mod_php, from the files PHP reads
* per-directory overrides: Apache php_value/php_flag, .htaccess, .user.ini
* application code that changes the serializer at runtime, through
ini_set('session.serialize_handler', ...) or session_start([...])
* pools or SAPIs that share one session.save_path with different
serializers (a session written in one format and read in another is the
shape of this bug class even without upload progress)
Usage:
./php-session-audit.sh full report
WEB_ROOTS="/var/www /srv" ./php-session-audit.sh
Exit: 0 = no precondition found, 1 = all three conditions met somewhere,
2 = partial match or something worth a look
Env overrides:
WEB_ROOTS="/var/www /srv/www" where to look for code and per-dir config
SCAN_DEPTH=10 how deep to lookThe Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
