Technical details have not been published. The advisory says PHP will provide a full advisory with its next regular release; meanwhile it recommends setting session.upload_progress.enabled=0 and restarting workers.
The advisory also covers CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. CERT-EU says both can permit unauthenticated remote code execution and that initial proofs of concept are circulating. PHP released fixes on 21 October in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Affected web-serving configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
CERT-EU recommends patching affected installations immediately. Where that cannot be done, it advises isolating internet-facing applications until fixes are applied and verified. It notes minimal source backports for PHP 7.4, 8.0, and 8.1, while older branches are otherwise end of life.
The source does not confirm active exploitation, disclose technical details for CVE-2026-115560, or identify every third-party product that embeds an affected PHP runtime.