PHP Warns of a New Unpatched Remote-Code-Execution Risk

PHP has disclosed a new unpatched issue, CVE-2026-115560, that could allow an attacker to run code on a web server under an unusual configuration. PHP considers the risk unlikely and has not issued an emergency fix.