There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic.

It is a non-default configuration and will not be a widespread issue.

The mitigations in this thread already fix it, if you want to panic.

https://fosstodon.org/@php/117489802289942474