PHP session upload progress RCE path, Sentry Next.js SDK bypass, Amazon Linux 2 log4j hotpatch

PHP: CVE-2026-115560 (session upload progress)

• What: An informational advisory on php.net, dated October 23, describes a narrow remote code execution path through session upload progress. It only triggers if an application switches session.serialize_handler to php at runtime, so most applications are unlikely to be affected.
• Severity: No score assigned yet.
• Exploited: Not known to be exploited.
• Fix: Expected in the next regular PHP release.
• Mitigation: Set session.upload_progress.enabled=0 in php.ini. This was already a listed mitigation for PHP2Shell, so servers that applied it then need no further change.

Sentry Next.js SDK: CVE-2026-114139

• What: CVE-2026-114139 is a middleware bypass in @sentry/nextjs that occurs when Sentry's tunnel route is used.
• Severity: Critical.
• Exploited: Not known to be exploited.
• Fixed in: @sentry/nextjs 9.47.2 and 10.75.2.
• Who should act: Next.js applications that use @sentry/nextjs with a tunnel route configured.

Amazon Linux 2 log4j hotpatch: CVE-2026-85656

• What: CVE-2026-85656 lets a local user gain root through the log4j-cve-2021-44228-hotpatch package.
• Exploited: Not known to be exploited.
• Fixed in: 1.3-9.
• Who should act: Amazon Linux 2 hosts with that package installed.

Also noted

• CISA's Known Exploited Vulnerabilities catalog entries for Next.js added on October 22 are covered by the existing Next.js fixes in 16.4.1 and 15.5.28.