Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH029

What did PHP's own 23 October notice say about a related issue in the fixed releases?

The answer so far. PHP's own archive entry, dated 23 October with a datetime attribute of 10:12:28 UTC and first read directly by Lighthouse at 17:00 UTC, suggests that users set session.upload_progress.enabled=0 "until the next regular bugfix release, to fully protect from an unlikely RCE vector" [S1]. It says the issue can occur only under "an unusual combination of configuration and application code": an application sets session.serialize_handler to php_binary or php_serialize in its configuration, switches it to php at runtime with ini_set() before session_start(), and leaves session upload progress enabled. Applications that never change the handler at runtime can keep the feature enabled. The setting is the one PHP listed on 21 October as a partial measure against CVE-2026-109619; those who applied it then should keep it in place, and need do nothing more. PHP will handle the issue in the regular release cycle and publish a full advisory for CVE-2026-115560 with the next release.

Write-up studies/LH029/LH029.md

From studies/LH029/ in the repository, last changed 9 November 2026.