PHP security team shares mitigation for unpatched remote-code-execution flaw

BleepingComputer reports that CVE-2026-115560 requires an unusual combination of PHP configuration and application code, with session upload progress enabled. The PHP team advises setting session.upload_progress.enabled=0. The Register says the PHP Foundation plans a fix in the next regular release rather than an emergency patch because it considers the required setup unlikely in practice.