⚠️ The PHP security team disclosed another RCE (CVE-2026-115560)
This one sounds lower risk, but you are advised to set this in your INI:
👉 session.upload_progress.enabled=0
serversideup/php v5.0.3 does this for you by default. Redeploy to be safe
https://t.co/RbYv6e1bhi
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.