{"cvss":0.0,"cwes":null,"datePublished":"2026-10-23","dateUpdated":"2026-10-23","description":"Bulk import, on request, of CVE-2026-115560: a PHP remote-code-execution risk announced in the PHP project's informational advisory \"Session upload progress\" (php.net, 2026-10-23), which has NO CVE record yet (cve.org returns 404, NVD has no entry). PHP calls it an \"unlikely RCE vector\" that \"can only occur under an unusual combination of configuration and application code\": an application must set session.serialize_handler to php_binary or php_serialize, then switch it to php at runtime with ini_set() before calling session_start(), with session upload progress still enabled. PHP is not issuing an emergency release: the mitigation is session.upload_progress.enabled=0 (already listed for CVE-2026-109619), the fix comes in the next regular bugfix release, and a full advisory will follow with it. PHP has not stated affected versions, a fixed version, a severity score, or whether it shares a root cause with CVE-2026-109619; The Hacker News (2026-10-23) reports it as separate from CVE-2026-109618 and CVE-2026-109619 and not fixed by their patches. IMPORTANT: this is an advisory entry, NOT a confirmed or assessed exploited vulnerability. PHP makes no exploitation claim, The Hacker News states that no exploitation of it has been reported (the attacks since 2026-10-21 target the two earlier flaws), it is not in CISA KEV (catalog 2026.10.21), CIRCL's KEV catalog has no entry, and CIRCL's 4 sightings (3 seen, 1 confirmed) include none of type exploited; the 'confirmed' one links to the PHP Foundation's X post, whose content CIRCL did not capture and which was not read. No PoC and no independent risk assessment was reviewed. Recorded with exploited=true per explicit user direction despite the absence of any exploitation signal, purely to reflect that it was requested.","dueDate":"","id":"CVE-2026-115560","kev_catalogs":["ndaal"],"knownRansomwareCampaignUse":"","product":"PHP","severity":"HIGH","source":"ndaal_kev","title":"CVE-2026-115560","vendor":"PHP Group"}