overused

🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560 The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. ⠀ PHP says exploitation requires an unusual configuration where an application: • Uses php_binary or php_serialize as its session serializer • Changes the serializer to php at runtime before session_start() • Has session upload progress enabled ⠀ PHP considers the risk unlikely and plans to release a fix during its next regular update cycle. Until then, administrators with affected configurations should set: session.upload_progress.enabled=0 Applications that do not change the session serializer at runtime are not exposed through this path. No exploitation has been reported. Source: php.net/