Cyber ·
PHP notice on session upload progress (CVE-2026-115560)
Informational PHP notice on session upload progress, identified as CVE-2026-115560, relayed by the oss-sec list on 23 October 2026. The received text does not describe the technical impact or the affected versions.
This Radar item records only what the source states: an informational PHP notice about session upload progress, identified as CVE-2026-115560. The message was posted on 23 October 2026 to the oss-sec mailing list feed by a list member, and it is an automatic translation of text pointing to PHP's own advisory archive. The text received gives no technical description of the problem, no list of affected versions, no fixed versions and no mitigation steps.
To consult and verify the original, open the official PHP notice in the 2026 archive (the 23 October entry) and the matching oss-sec message. Check there the scope, the affected PHP versions, the date and the recommendations. Then compare them with the PHP version your application runs and check whether an update is available through your distribution's official channels.
The relevance for an organization using PHP with upload and session features lies in inventorying where those features exist and applying the fix when the official notice confirms it applies. Rota Nacional does not patch PHP and does not replace that analysis. When an application calls the Rota API, the personal data barrier acts on the content sent to the model, but it does not remove vulnerabilities in the software making the call.
Original source: Aviso informativo do PHP: progresso de upload de sessão (CVE-2026-115560)