PHP

Inside PHP CVE-2026-115560: Session Upload Progress & Serialize Handler Mismatch Explained

Cutting through the clickbait around PHP's CVE-2026-115560 (CVSS 6.4) advisory: How runtime changes to session.serialize_handler collide with session.upload_progress to trigger PHP Object Injection, and the one-line php.ini mitigation.