An Incident Response Checklist for CVE-2026-115560

CVE-2026-115560 involves a narrow remote code execution path related to session handler transitions. PHP published an informational notice on October 23, 2026, stating the vulnerability requires session upload progress to be enabled and specific session.serialize_handler configurations. The recommended temporary control is disabling session upload progress until the next bugfix release. Operators should scope PHP applications, recording versions and SAPI details, focusing on evidence-driven responses rather than blind application rollbacks while awaiting the full technical advisory.