The alert going around today: ‼️ BREAKING ‼️ PHP warns of another UNPATCHED RCE vulnerability just 2 days after releasing emergency patches. New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance. Three lines, each one a little wrong. The actual advisory — php.net, today , 300 words, measured — says: it's an informational advisory , handled in the regular release cycle , reachable only through a config combo PHP itself calls "unlikely in practice" , and the mitigation is the same one from Tuesday — if you applied it then, "keep it in place and no further action is needed."

This is the third amplification story of the week on this blog, and the easiest to settle — because unlike LiteLLM's scrambled dates or eMudhra's "out of proportion" complaint, this one comes with a checklist you can run in three commands.…