From 6adf7769d66e1c25a62febf8b502767d99f7c007 Mon Sep 17 00:00:00 2001 From: Aran Reeks Date: Sun, 25 Oct 2026 09:34:11 +0000 Subject: [PATCH] Disable session upload progress API Gateway and Lambda receive the whole request before PHP runs, so upload progress can never be tracked. Disabling it removes the attack surface of CVE-2026-115560, as recommended by PHP until the next release. Co-Authored-By: Claude Opus 5.5 --- src/php-85.ini | 5 +++++ src/php.ini | 5 +++++ tests/test_2_extensions.php | 2 ++ 3 files changed, 12 insertions(+) diff --git a/src/php-85.ini b/src/php-85.ini index a78fe25f..a79712da 100644 --- a/src/php-85.ini +++ b/src/php-85.ini @@ -50,6 +50,11 @@ disable_functions=fastcgi_finish_request post_max_size=6M upload_max_filesize=6M +; API Gateway and Lambda receive the whole request before PHP runs, so the progress +; of an upload cannot be tracked: disable it to reduce the attack surface (CVE-2026-115560) +; See https://www.php.net/manual/en/session.upload-progress.php +session.upload_progress.enabled=0 + extension_dir=/opt/bref/extensions ; Extensions enabled by default extension=mbstring diff --git a/src/php.ini b/src/php.ini index 17b90f2e..686f3da8 100644 --- a/src/php.ini +++ b/src/php.ini @@ -50,6 +50,11 @@ disable_functions=fastcgi_finish_request post_max_size=6M upload_max_filesize=6M +; API Gateway and Lambda receive the whole request before PHP runs, so the progress +; of an upload cannot be tracked: disable it to reduce the attack surface (CVE-2026-115560) +; See https://www.php.net/manual/en/session.upload-progress.php +session.upload_progress.enabled=0 + extension_dir=/opt/bref/extensions ; Extensions enabled by default extension=mbstring diff --git a/tests/test_2_extensions.php b/tests/test_2_extensions.php index 41a627f7..970c66f4 100644 --- a/tests/test_2_extensions.php +++ b/tests/test_2_extensions.php @@ -63,6 +63,8 @@ 'readline' => READLINE_LIB === 'readline', 'reflection' => class_exists(\ReflectionClass::class), 'session' => session_status() === PHP_SESSION_NONE, + // Disabled in bref.ini (CVE-2026-115560) + 'session-upload-progress' => ini_get('session.upload_progress.enabled') === '0', 'ffi' => class_exists(\FFI::class), 'zip' => class_exists(\ZipArchive::class), 'zlib' => md5(gzcompress('abcde')) === 'db245560922b42f1935e73e20b30980e',