The 'BREAKING' unpatched PHP RCE that wasn't: what CVE-2026-115560 actually requires

A 'BREAKING: unpatched PHP RCE' alert is going around. The actual php.net advisory for CVE-2026-115560 says something quieter, stranger and more useful: an unlikely config combo, the same mitigation you already applied, and three lines of grep to know if it concerns you.