CVE-2026-115560: Another PHP flaw awaits a patch, but one setting fully protects you

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

Another PHP flaw awaits a patch, but one setting fully protects you

On October 23, the PHP team disclosed CVE-2026-115560, exploitable only in a rare configuration. Here is the setting to apply and how to tell whether your application is affected.

Oct 24, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)