Posted by Alan Coopersmith on Oct 23 https://www.php.net/archive/2026.php#2026-10-23-1 advises:
PHP Informational advisory: Session upload progress (CVE-2026-115560)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/359
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Before you file that AI bug report, OpenAI has some advice
Even OpenAI is admitting there is a lot of AI slop in the security space. An executive for the frontier AI company said Tuesday that AI-generated vulnerability reports…
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept…
Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)
Posted by Peter Wolanin on Oct 26 The PPA we use https://launchpad.net/~ondrej/+archive/ubuntu/php had a PHP 5.6 back port the same day. Have you compared your patch to…
Experts temper emergency-level alarms over critical Brotli defect
Alarm bells ratcheted up yet again about an AI-discovered vulnerability that could — if exploited in the wild — destabilize vast stretches of the internet. The critical…
PHP Publishes Mitigation Advice for New RCE Flaw
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected
Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)
Posted by Demi Marie Obenour on Oct 25 In light of the size of the upstream patch, would it be better to handle out of memory by crashing the process instead?