PHP Warns of Separate Unpatched RCE Path and Recommends Disabling Upload Progress
PHP disclosed CVE-2026-115560 on October 23, 2026. The issue affects an unusual application configuration, is not fixed by the latest PHP2Shell patches, and can be mitigated by disabling session upload progress.