RuntimeNeeds attention

CISA lists the original two flaws as known exploited. The separate session upload progress flaw was not in CISA's catalog on November 9.

Update the PHP runtime using the vendor advisory, and assess CVE-2026-115560 separately. Ask your hosting provider to confirm fixes if it manages PHP.

• PHP security advisory
• PHP session upload progress advisory

The decoder is used beyond Node.js, including in server-side fetches. The October 25 review did not confirm active exploitation.

Update or remove vulnerable Brotli decoders using each vendor's guidance, including copies bundled with runtimes or container images.

• Node.js security advisory