Another PHP remote-code execution risk reportedly affects unusual session setups

Two October 23 posts say CVE-2026-115560 is separate from two PHP2Shell flaws patched earlier that week. They describe an unusual attack path requiring specific session serializers, a runtime switch to php and enabled session upload progress. The posts say PHP considers exploitation unlikely, advises affected administrators to disable session upload progress and plans a fix in its next regular update. No exploitation of the new flaw has been reported.