Two days after the emergency patch that took sites offline around the world, PHP published today an informational advisory for a third flaw in the same session subsystem. CVE-2026-115560 has an official description, a known mitigation and no fix for now.
The advisory is calibrated and short
The mitigation is the same line from the 21st: session.upload_progress.enabled=0, which per the project fully protects against this vector, considered unlikely in practice. Whoever applied the line when advisory GHSA-6wmf-4rv5-p3rp came out is already covered, and the text says it literally: no additional action is required.
The technical detail that explains the calm
The vector requires an unusual combination of configuration and code: the application needs to configure session.serialize_handler as php_binary or php_serialize and then switch it to php at runtime, via ini_set, before opening the session, with upload progress still enabled. An application that never switches the handler at runtime may keep the feature enabled, says the official advisory.
The context that forbids sleeping on the unlikely
Exploitation of the original pair began four days before disclosure, per Amazon, and SecurityWeek reported Mirai operators joining the attacks with ASLR bypass, with attempts in the millions. In that climate, the criterion stops being probability: a one-line mitigation at zero cost justifies itself.
The week of three disclosure temperatures
The week left three cases on the same theme, with three disclosure temperatures. PHP2Shell leaked early and became a global emergency; the kernel disclosed two unpatched RCEs by process accident; and today''s PHP shows the mature version of the exercise: an unlikely condition documented precisely, a one-line mitigation and a fix in the regular cycle.
For those following the series: Tuesday''s inventory already paid today''s bill. At Tech86, that is exactly how we operate: what was mitigated once stays documented, and every new advisory is checked against what is already applied.
Conclusion
The check takes two minutes and the next advisory may not be unlikely. What separates the mature response from the scramble is the inventory: a mitigation documented once serves every following advisory for the same subsystem, and that is what turns disclosure week into operating routine.