PHP ships a release that fixes CVE-2026-115560 (the third bug) by Nov 21
The index says: likely (80%). Graded on that date, right or wrong, in public.
Why the index thinks so
PHP flagged the third bug on Oct 23 and said it needs an unusual session configuration, so the fix waits for the next regular bugfix release rather than another emergency one. PHP's regular releases run on a roughly four-week cycle, which lands inside this window; a slip of a week would resolve this No.
What would move it
php.net release announcements; the changelog for the 8.5.x, 8.4.x and 8.3.x branches.