We’ve kept upload_progress disabled, and PHP.net have again confirmed this as being wise.
CVE-2026-115560 will be patched in an upcoming release, and for now keeping it disabled mitigates it.
Google patched a flaw in Brotli on the 28th of Feb yet didn’t release it as a patch until the 22nd of Oct.
CVE-2026-111497 is mitigated: we upgraded to brotli-1.0.6-5 which addresses the out-of-bounds write.
It’s good to see eMudhra exiting the SSL/TLS market after their CA Private Key blunder, including “4”…
CVE-2026-114406 is mitigated: we upgraded to ca-certificates-2026.2.92 which fully distrusts eMudhra.