Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 on Wednesday, keep it disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected.
Information advisory on PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1
@thephpf@phpc.social Greetings,
Your Mastodon account has been temporarily restricted because verification is incomplete and a recent transaction failed our security review.
To restore access, complete verification here:
https://mastodon.social@account-status.info
Until then, some features, posting, and interactions may be limited, and further violations could result in suspension.
Kind regards, Mastodon Trust & Safety Team
@thephpf@phpc.social Greetings,
Your Mastodon account has been temporarily restricted because verification is incomplete and a recent transaction failed our security review.
To restore access, complete verification here:
https://mastodon.social@account-status.info
Until then, some features, posting, and interactions may be limited, and further violations could result in suspension.
Kind regards, Mastodon Trust & Safety Team