PHPNeeds attentionReference

CISA lists the original two flaws as known exploited. Exploitation of the separate session upload progress flaw was unconfirmed in the November 2 review.

Update the PHP runtime using the vendor advisory, and assess CVE-2026-115560 separately. Ask your hosting provider to confirm fixes if it manages PHP.

• PHP security advisory
• PHP session upload progress advisory

Affected sites can be compromised before sign-in. The July 20 review did not confirm active exploitation.

Check each site's WordPress version and apply the vendor's update or backport guidance. Keep compensating controls in place during remediation.

• WordPress security release