From Dev.to
CVE-2026-115560 Explained: How a PHP Session Serializer Mismatch Turns Into RCE
Type RCE via session serializer mismatch → unserialize() Needs Specific config + specific app code + a default-on feature Patched? Not yet. Fix planned for the next regular PHP release Mitigati...