/ Register

Welcome to Centmin Mod Community
Become a Member

Beta Branch add session.upload_progress.enabled = 0 CVE-2026-115560 mitigation in…

Discussion in 'Centmin Mod Github Commits' started by eva2000, Oct 24, 2026 at 1:54 PM.

Previous Thread Next Thread
Loading...
  1. Oct 24, 2026 at 1:54 PM #1
    eva2000

    eva2000 Administrator Staff Member

    60,106
    12,587
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,244
    Local Time:
    5:01 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    add session.upload_progress.enabled = 0 CVE-2026-115560 mitigation in 140.00beta01

    php.net advises session.upload_progress.enabled=0 until the next PHP
    release to block an RCE path (CVE-2026-115560) that also needs a runtime
    session.serialize_handler switch:
    https://www.php.net/archive/2026.php#2026-10-23-1

    PHP 8.2+ releases still run the session upload progress callback. The
    PHP 7.2-8.1 CVE-2026-109618 backports already disable it in code.

    Changes:
    - inc/phpsededit.inc: phpsededit() writes session.upload_progress.enabled = 0
    to a_customphp.ini on new installs and menu 5 PHP upgrades

    Continue reading...

    140.00beta01 branch
     
Previous Thread Next Thread
Loading...

.