Mooty

After digging a little in the PoC code (here https://jackalsyn.com/posts/php-up-2026.html) I'm quite confident it's not a completely working one.

It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.

This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.

But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.

After digging a little in the PoC code (here https://jackalsyn.com/posts/php-up-2026.html) I'm quite confident it's not a completely working one.

It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.

This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.

But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.

If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.

Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }

You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off

If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.

Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }

You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off

How do they even test this on a model ? I mean it's a multimodal i get that but response time are too big or am i missing something ?

Agree as well he has lost his mind in the battle and does not appear to be trustable in such a competitive market at current state of things (well .. ai).

Probably a good move to move on with someone else that doesn't need to get microdosis at burning man yearly to get ideas.

I created a cute minecraft spinoff for my son out of his origins (french/thai). All in browser, works on desktop tablet and smartphones. Localised in english and French.

He is loving it right now.

Happy to see no one cares but anyway github is here https://github.com/mdrbx/nerv-ui

Did you use any library to go from html to json ? Did you have any inconsistensies with stuff like "<div>text<span> is <span> really</span><b> difficult to convert to json</b><span></div>" ?

I think using 3rd party API might help with latency as they won't have the same latency problem.

I've copied a project that basically sends a message to telegram with informations when someone connects on a linux server.

But this time it's for MS Teams channels, which is possible through Webhooks.

I thought that might be interesting for other persons so I share :) It can probably be adapted to any other webhooks, as soon as webhook urls accepts the JSON sent.

Can't promote this enough. Same here except wife is photographer and her studio is at home so I took a coworking pass. The biggest challenge is to remain curious and have the guts to go out for something else than drinking beers with strangers.

Would love to see a PWA from this, as most I've found are basically ugly. Congrats for the work done.

PS : Please use another color scheme or put a dark mode somehow, my wife will kill me if I open the app at night.

I wonder if you could turn this with a Google Spreadsheet into a real DB system with writing access and a little obfuscated security wrapper.

Selling few delivery plugins for woocommerce/prestashop was a really nice idea at the time which did not really work that much before pandemic (for ex https://codecanyon.net/item/stuart-for-woocommerce/25673890)

Did some, transfer costs beetween instances that serves as plot generators are f** expensive. You need TB of data transfers, for example 15TB to transfer on the internet is somewhere around 1500$.

Maybe what you are searching for is just a html page exported.

Is this GrapesJS ;) ?

Third party temporary reading for medical datas. For instance any kind of temporary access for something you need to keep private most of the time might be achieve through smart contracts.

No one mentions the fact that jQuery is still used in Wordpress (33% of all websites) everywhere and (as far as I know) in the last theme version they provided this year. Which makes it somehow the biggest library around in terms of usage. I'm still confused why people needs node/react or vue to achieve simple thing that back in the days where pretty easy to do with basic php/jquery. Simplicity in coding was better at the time.

Maybe ecommerce or anything else, as it's also a bulletproof framework.

Bravo les gars :)

Sincerly nice project, I would do one myself if I had the time or knowledge. What could be really nice is that make a DIY video to demonstrate it's easy and link to where we can buy different stuff (and put a affiliate link, please). Also suggest controllers that are compatible with steam if that exists.

Still looking for stuff to replace Wordpress and jQuery in this area. This trend is cool but requires a technical hurdle way bigger than before with lots of tradeof (backward compatibility/easy introduction to programming/performances on frontend).

I'm surprised no one mentionned Prestashop here. Aside WooCommerce this is a really solid solution since years now, that can scale and have real plugin official marketplace with verified contributors. WooCommerce has way more hassle ...

Actually it might have some simple benefits : clients are willing to pay to have a separated database and a separated server from anything else for security purpose. All of our clients at https://www.bluelearning.fr have their own separated DB when they choose it. So far it has been a huge hit, as most of them paid more just for this.