[JoshRob297]

Patch state re-checked against php.net and php-src on 2026-11-09. No finding changes; the coverage matrix now records what a reader needs before deciding whether to update.

What is current

• Latest stable is still 8.4.27 / 8.5.12 (21 Oct). 8.4.28 and 8.5.13 exist only as RC1, tagged 3–4 Nov for testing.
• CVE-2026-115560 has no stable fix. The full advisory is unpublished and the 23 Oct mitigation stands: session.upload_progress.enabled=0.
• php-src PR #22113 — ext/session: prevent creation of fixed sid in php_session_rfc1867 — is still open, so the fixed-SID guard measured as absent in the coverage matrix is absent from every release, not only from 8.4.27.
• 8.4.27 / 8.5.12 shipped a regression: GH-24488, a SimpleXMLElement GC double free ending in zend_mm_heap corrupted, fixed in php-src for 8.4.28. A host on 8.4.27 that corrupts its heap under heavy SimpleXML use is hitting that, not this cluster.

Also in this release

• RESUMEN.md comes back as a three-line redirect to REPORT.es.md. The bilingual restructure renamed it and old links were still being visited.
• README badges and status point at this release.

Unchanged

Every measurement, the withdrawn cookie counts (12/12 and 15/15), and the open gaps — the display_errors=Off + ASLR-on remote chain with our own cookie is still not achieved, and that is still the honest state.