There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic.
It is a non-default configuration and will not be a widespread issue.
The mitigations in this thread already fix it, if you want to panic.
https://fosstodon.org/@php/117489802289942474
Kevin Beaumont
npub1lc…6lcye
2026-10-23 12:17:25 UTC
in reply to nevent1q…6lth
Author Public Key
npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcyePublished at
2026-10-23 12:17:25 UTCEvent JSON
{
"id": "db77c791131a1897c2403c54e9e5a35cf513a39cc4fc08ea31fb7f4b80774618",
"pubkey": "fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd",
"created_at": 1792757845,
"kind": 1,
"tags": [
[
"p",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"proxy",
"https://cyberplace.social/@GossiTheDog/117490178168589732",
"web"
],
[
"e",
"d0c6c3f1e8f141a739a32a045fb2ab9e6132f3d8c734a38d13782e5f9bcfe4d7",
"",
"root",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"e",
"3419e2a466b16fe2520fe6393c73782760a817bf4545f38d09e9562ad79e4a30",
"",
"reply",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"proxy",
"https://cyberplace.social/users/GossiTheDog/statuses/117490178168589732",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://cyberplace.social/users/GossiTheDog/statuses/117490178168589732",
"pink.momostr"
],
[
"-"
]
],
"content": "There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic. \n\nIt is a non-default configuration and will not be a widespread issue. \n\nThe mitigations in this thread already fix it, if you want to panic. \n\nhttps://fosstodon.org/@php/117489802289942474",
"sig": "4bad738eb67c94c1c0a1e48ac367cf23c515e403046b744ea6ca487bee6955210d61306a6aa5d35ca5ae55db5cfcda9263298d3832072e1773ca3e46bfc366b1"
}