News for hackers. Stuff that matters.

A comment on Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming.

Re:Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming by potaytopotahto on Tuesday October 20, 2026 @09:27PM (#50174955)
Looks like details about the exploits have already leaked on twitter, if the info is correct then it can be mitigated by setting session.upload_progress.enabled = Off until you get the opportunity to update
[ Parent | on HN ]
Re:Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming by 4lun on Wednesday October 21, 2026 @01:55AM (#50176602)
Not enough apparently

> The PHP 8.6 release manager is on Reddit saying this can’t be fixed with ini settings alone, and needs PHP to be patched

https://x.com/johnplaysdf/status/2112737802379047099?s=46

> INI settings alone won't protect you. You need to patch PHP.

https://www.reddit.com/r/PHP/comments/1xb2utu/comment/phyu5m...

[ Parent | on HN ]