Repository navigation
Security: Disable session upload progress by default and upgrade FrankenPHP to 1.13.2 - #731
Merged
Merged
Conversation
Add PHP_SESSION_UPLOAD_PROGRESS_ENABLED and default it to 0, following PHP's October 23 advisory for CVE-2026-115560.
jaydrogers
marked this pull request as ready for review
October 23, 2026 12:33
Deploying serversideup-php with
|
| Latest commit: |
8f39339
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://6dab1ad1.serversideup-php.pages.dev |
| Branch Preview URL: | https://security-v5-0-3.serversideup-php.pages.dev |
jaydrogers
changed the title
Contributor
Images for PR #731
Try it: docker run --rm -v "$PWD:/var/www/html" -p 8080:8080 serversideup/php-dev:731-8.5-fpm-nginxEvery image is on Docker Hub as All images with sizesSizes are compressed, per architecture.
Updated on every push to this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR turns off PHP's session upload progress feature by default and upgrades FrankenPHP to 1.13.2.
PHP_SESSION_UPLOAD_PROGRESS_ENABLED=1to turn it back on.Session upload progress
CVE-2026-115560 is a new vulnerability, not one of the two PHP fixed on October 21. The patched PHP versions in v5.0.2 don't fix it. PHP will publish the details and the fix in its next regular release. Until then, they recommend turning upload progress off.
It only affects a rare setup. An app has to change the session serializer at runtime before starting a session. Our images don't do that by default. Turning the feature off is still safer than asking everyone to check their app.
The only apps affected are ones that show upload progress using PHP's built-in sessions.
FrankenPHP 1.13.2
These fixes apply to our images:
The PHP and embedded app fixes in that release don't apply to us. v5.0.2 already ships the patched PHP. We don't ship embedded builds. Go and Caddy versions don't change.
Tested locally
CI is the first build of the other variations and of Alpine. This is v5 only.
How to test
scripts/dev.sh --variation fpm-nginx --version 8.4 --os bookworm docker run --rm --entrypoint php serversideup/php:8.4-fpm-nginx-bookworm -i | grep upload_progress.enabled scripts/test-image.sh serversideup/php:8.4-fpm-nginx-bookwormRepeat with
--variation frankenphp.