CVE-2026-115560: Reserved at cve.org. Talked about by public sources before its record is published.

Not yet published4 mentionsTrends rank 10 this month
Open at cve.orgSee it in Security trends

This page exists because public sources are talking about CVE-2026-115560 before its record is published. It is not indexed by search engines, and it becomes the full record at this same URL once the CNA publishes.

Priority
Not yet publishedreserved at cve.org

The id is reserved at cve.org, but NVD and cve.org have no description, severity or affected products yet.

Next step: Treat the mentions below as unconfirmed. If a source names your product, read its advisory directly.

How is this decided?
Official record
cve.org
Reserved, no details
NVD
No record yet
CVSS
None yet
EPSS
None yet

cve.org is checked again every hour while the id is reserved.

Public attention
4mentions from 4 independent origins
First seen
2026-10-22 00:00 UTC
Trends
Rank 10 this month

What the sources say

Earliest first · the sources' own words, not verified by CveMate
  1. CERT-FR alerts (alerte)bulletin
    [Màj] Multiples vulnérabilités dans PHP (21 octobre 2026)

    **[Mise à jour du 26 octobre 2026]** Le 23 octobre 2026, PHP a publié un avis de sécurité concernant la vulnérabilité CVE-2026-115560. Celle-ci permet une exécution de code arbitraire à distance. L'éditeur estime que les conditions d'exploitation exigent une combinaison d'options de configuration...

  2. Hacker News (Algolia search)community
    PHP advisory: disable session upload progress to prevent another unlikely RCE

    Informational advisory: Session upload progress We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published…

  3. Snyk blogpublisher
    PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560]

    Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.

  4. Infosecurity Magazinepublisher
    PHP Publishes Mitigation Advice for New RCE Flaw

    PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected

What happens next

  1. 1The CNA publishes the record

    Description, affected products and usually a CVSS vector appear at cve.org. NVD enrichment follows, often within days.

  2. 2This page becomes the full record

    Same URL, with the description, severity, affected products and references of the published record.

  3. 3It gets a Priority label

    Remove now, Act now, Prioritise, Routine or Insufficient evidence, from the published evidence only. Public talk never sets the label.

Until then: if a source names your product, check its advisory directly. A fix published before the CVE is still a fix.