CVE-2026-115560

hype MIXED · 42 hack

Real advisory, credible vendor signal, but no PoC, KEV-unlisted, narrow scope limits exploitation likelihood.

What: Remote code execution in PHP's session handler via upload progress tracking; affects installations with non-default session configurations (CVSS/EPSS not yet published).

Why it matters: PHP issued advisory two days after PHP2Shell emergency patches; mitigation (disabling session.upload_progress) available now, but no emergency patch planned—fix deferred to regular release cycle. KEV not listed; credible vendor advisory from php.net confirms real vulnerability, though narrow attack surface compared to PHP2Shell.

Where it's seen: European and international security community chatter on Bluesky; Hacker News coverage; Synology NAS advisory; defenders discussing mitigation steps; comparative framing against concurrent PHP2Shell crisis.

RISK: MODERATE — Narrow attack surface; mitigation available; deferred patching reduces urgency vs. PHP2Shell.

Generated by claude-haiku-4-5 from public posts and authoritative metadata. AI can make mistakes — verify against vendor advisories before acting. 10/24/2026, 7:03:08 AM

No NVD details ingested for this CVE yet.