The PHP Foundation (@ThePHPF)

Fri, Oct 23

Will this week ever end? Quoting @ThePHPF: "Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to…

X (formerly Twitter)The PHP Foundation (@ThePHPF) on XSet session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

Alexander Danilov @adapik6d66989b1

This CVE story made one thing clear: millions of businesses, governments and hospitals run on PHP, yet only a handful of people maintain it. If your company relies on PHP, back @ThePHPF and help grow the core team. #PHP

Raphael Stolt @raphaelstoltquoted6d

This 👇🏼.

Wed, Oct 21

stemonte @monteduroOct 21cae55c2

PHP >>>>>> Quoting @vanamerongen: "TL;DR: @ThePHPF security team had been working round the clock since august and with multiple parties to coordinate smooth patching... only for people to disclose 2 days before scheduled release. I feel so bad for you guys 💔"…

X (formerly Twitter)Pauline Vos (@vanamerongen) on XTL;DR: @ThePHPF security team had been working round the clock since august and with multiple parties to coordinate smooth patching... only for people to disclose 2 days before scheduled release. I feel so bad for you guys 💔