News for hackers. Stuff that matters.

A comment on PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619).

Re:PHP session.upload_progress heap UAF (CVE-2026-109618 / -... by InvisibleUp on Wednesday October 21, 2026 @01:37AM (#50176473)
This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
[ Parent | on HN ]
Re:PHP session.upload_progress heap UAF (CVE-2026-109618 / -... by charcircuit on Wednesday October 21, 2026 @01:48AM (#50176546)
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.
[ Parent | on HN ]
Re:PHP session.upload_progress heap UAF (CVE-2026-109618 / -... by 4ndrewl on Wednesday October 21, 2026 @02:44AM (#50176922)
Which is also what tfa says btw
[ Parent | on HN ]