PHP has a new flaw with no patch, and the mitigation is the setting we said was not a workaround
2026-10-27Security
CVE-2026-115560 needs three conditions to line up, has no fix yet, and the official advice is to disable session upload progress. For PHP2Shell that was not a fix. Both statements are correct.