Written by Shahrukh Akhtar, Technology Executive & Product Builder. Engineering leadership, Laravel at scale and product strategy.
PHP’s suggested stopgap for CVE-2026-115560 is session.upload_progress.enabled = Off. Here’s a Forge Recipe that applies it safely on every PHP-FPM version, checks that it worked, and lets you roll it back.
Two critical unauthenticated RCE flaws, CVE-2026-109618 and CVE-2026-109619, were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Who’s affected, how to check, and what to do today.
