CVE-2026-115560 Explained: How a PHP Session Serializer Mismatch Turns Into RCE
php
dev.to
TL;DR Type RCE via session serializer mismatch → unserialize() Needs Specific config + specific app code + a default-on feature Patched? Not yet. Fix planned for the next regular PHP release Mitigation session.upload_progress.enabled = 0 Exploited in the wild? Not reported as of the advisory Severity Some sources list vendor CVSS v4 9.2 (Critical), but PHP had not published an official score or affected-version list yet Background in 3 minutes