Upcoming Critical PHP Security Release

Re:Upcoming Critical PHP Security Release by potaytopotahto on Tuesday October 20, 2026 @09:29PM (#50174964)

Details about the exploits have already been leaked on twitter, don't want to put the details here but if its correct then it can be mitigated by setting session.upload_progress.enabled = Off

[ Parent | on HN ]

Re:Upcoming Critical PHP Security Release by bpbp-mango on Wednesday October 21, 2026 @12:19AM (#50176036)

session.use_strict_mode = 1 as well. some advice around disabling multipart uploads too.

[ Parent | on HN ]

Re:Upcoming Critical PHP Security Release by qingcharles on Wednesday October 21, 2026 @12:01AM (#50175941)

Sadly this says it's probably not enough:

https://phpc.social/@Girgias/117476477429221001

[ Parent | on HN ]

Re:Upcoming Critical PHP Security Release by EGreg on Tuesday October 20, 2026 @10:30PM (#50175330)

I have heard Kirill Firsov say that, but does anyone even know the vulnerabilities? Could be a meme.

[ Parent | on HN ]

Re:Upcoming Critical PHP Security Release by potaytopotahto on Tuesday October 20, 2026 @10:37PM (#50175389)

Yes its two hanging pointers related to the upload progress handler that can be used for RCE after some heap grooming, disabling upload progress means that the function that contains the vulnerable code never runs.

[ Parent | on HN ]