GoKawiilPHP discloses unpatched RCE flaw, offers mitigation instead of patch
The PHP security team issued an advisory for CVE-2026-115560, a remote code execution vulnerability that only affects systems with a specific non-default configuration involving session serialize handlers and session upload progress. No patch exists yet; PHP maintainers instead recommend disabling session.upload_progress as a temporary mitigation, with a full fix expected in a future regular release. This follows closely behind PHP's patching of two other critical flaws collectively called PHP2Shell.