CVE-2026-115560 Evidence Review: What Operators Can Confirm Today
An effective vulnerability response separates what the vendor published from what the internet can observe and what a local team can prove. CVE-2026-115560 has a clear mitigation and a narrow set of conditions, but its full technical advisory is still pending. That makes evidence discipline more important than a dramatic risk label.
Vendor evidence
PHP published the informational notice on October 23, 2026. The exact condition involves configuration that sets session.serialize_handler to php_binary or php_serialize, followed by a runtime ini_set() change to php before session_start(). Session upload progress must be enabled. PHP calls the RCE vector unlikely and recommends disabling upload progress until the next regular bugfix release.
The notice says applications that never change the handler at runtime can keep the feature enabled. It also says a full advisory will follow. It does not publish a complete affected-version list, a CVSS score, or a detailed exploitation narrative. Those are absences in the record, not invitations to fill them with assumptions.
Vendor corroboration
Red Hat describes the mitigation as fully protective for this issue and explains how to enforce it for FPM and Apache. It recommends php_admin_value, auditing local overrides, checking the web configuration rather than the CLI, and restarting workers. cPanel notes that affected versions remain unknown because the full advisory has not been released.
The sources agree on the narrow condition and the temporary control. They do not turn the issue into a broad claim that every PHP installation is exploitable. cPanel's explicit version gap and PHP's promise of a later advisory should both be preserved.
External measurement
The selected ZoomEye Search was app="PHP". It returned 111,111,696 product fingerprint matches on November 6, 2026. That is a broad PHP population count, not a count of installations that meet the configuration conditions for CVE-2026-115560. The separate Filter vul.cve="CVE-2026-115560" returned zero. The Search count is therefore the Exposure value, but it must not be read as confirmed vulnerable assets.
The Search link is ZoomEye.
Local evidence
The only way to confirm a local match is to inspect the effective configuration and application path. Find the initial handler, the runtime change, the session start order, and the upload progress setting. Confirm the values in the production SAPI and record the deployment identity. If the code path is unreachable, record the network or application control that limits access.
This evidence should be timestamped. A later PHP release may change the version matrix, and a later deployment may change the handler behavior. A useful record includes the application owner, environment, evidence source, control status, and next review date.
Action
Disable session upload progress where the condition may exist, enforce the setting outside application control, restart workers, and test upload behavior. Continue to track the next regular PHP release for the complete fix and advisory. Avoid describing the external count as confirmed vulnerable systems, and avoid describing the absence of a CVE Filter result as proof that no local match exists.
