AWS lightsail: Add CVE-2026-115560 PHP advisory and mitigation guidance
Summary
Adds a note about PHP CVE-2026-115560 disclosed October 23, 2026, which existing PHP versions do not fix, and recommends setting session.upload_progress.enabled = 0 in php.ini as a workaround.
Security assessment
The diff explicitly references a specific disclosed PHP vulnerability (CVE-2026-115560) affecting session handling and provides a concrete configuration mitigation (disabling session.upload_progress), which is direct vulnerability remediation guidance.
Evidence
+On October 23, 2026, the PHP project disclosed CVE-2026-115560, which the versions in the preceding table don't fix. Until a fixed PHP version is released, set `session.upload_progress.enabled = 0` in `php.ini`, as the PHP project recommends. Only applications that change `session.serialize_handler` to `php` at runtime are affected. For more information, see the [PHP informational advisory](https://www.php.net/archive/2026.php#2026-10-23-1).
Diff
diff --git a/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md b/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md index aca6089..867498e 100644 --- a//lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md +++ b//lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md @@ -36,0 +37,4 @@ If your Lightsail instance runs PHP, we recommend that you update it as soon as +###### CVE-2026-115560 isn't fixed yet + +On October 23, 2026, the PHP project disclosed CVE-2026-115560, which the versions in the preceding table don't fix. Until a fixed PHP version is released, set `session.upload_progress.enabled = 0` in `php.ini`, as the PHP project recommends. Only applications that change `session.serialize_handler` to `php` at runtime are affected. For more information, see the [PHP informational advisory](https://www.php.net/archive/2026.php#2026-10-23-1). +