PHP team shares mitigation for unpatched code-execution flaw requiring unusual session settings and application code

CVE-2026-115560 could allow remote code execution only with an unusual combination of PHP session settings and application code, BleepingComputer reports. The PHP team advises affected setups to disable session upload progress. The Register reports that the PHP Foundation plans a fix with the next regular release rather than an emergency update; its executive director considers the required setup unlikely in practice.