REPORTED DEVELOPMENT
CVE-2026-115560 concerns runtime changes to the session serializer during upload-progress handling in uncommon configurations. A regular-release fix is forthcoming; disabling session.upload_progress.enabled is the stated interim measure.
AWS WAF PHP rules 2.4 adds PHP2Shell_BODY_Extended. Configurations pinned to 2.3 do not receive it automatically; body inspection provides only partial coverage of the third CVE. WAF remains different from a complete software patch.
WHY IT MATTERS TO THE MARKET
A further vulnerability and rule-version changes alter exposure and mitigation; an earlier control does not automatically cover a later issue.