風險
CISA lists the original two flaws as known exploited. The separate session upload progress flaw was not in CISA's catalog on November 9.
建議操作
Update the PHP runtime using the vendor advisory, and assess CVE-2026-115560 separately. Ask your hosting provider to confirm fixes if it manages PHP.