esnard

Informational advisory: Session upload progress

We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.

The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.

Nice article! Thanks for experimenting and writing it.

I'm curious if some of the animals / vehicules might force the models to use more tokens than others, and I could not find the token counts in the shared data, is it possible to publish it please? :)

Could this be the correct link?

https://arxiv.org/abs/2412.06056

Also discussed here: https://news.ycombinator.com/item?id=48307237

Nice find! Have you contacted the vendor to check if they're planning a fix?

I missed that, thanks!

Wow, is it related to the "make me a sandwich" XKCD?

https://xkcd.com/149/

No more vulnerabilities then I guess!

I spoke to a few people living in Iran, and they definitively confirmed that 100+ people died. They obviously don't have the exact number, so that 36,500 figure might be exaggerated, but there are more than enough videos online to verify the 100+ claim if you really want to.

If you're using the same domain for each of your email address, HIBP has a domain-wide search feature which is free (but you need to register to validate your domain)

5894 means that the password appeared 5894 times in the dataset.

5894 is not the password associated with the hash.

Link for anyone willing to contribute: https://github.com/bagder/http3-explained

Looks unmaintained, though.

I know nothing about the Ruby ecosystem, but I really do appreciate that someone cares that much to mediate this mess. Thank you.

> This feature is available in English for users in the US, Canada, UK, and Australia, and is being introduced gradually to ensure great performance and quality.

Not available in Italy yet.

Weird. The file was cracked in May 2024, while the password had appeared in a database leak which was added in HIBP (and thus pretty much public) back in October 2017.

Unsure why it took the community so long to crack the file.

Note: one of the founders of the World app is Sam Altman.

Related links:

- Vulnerability Disclosure FAQ ( https://googleprojectzero.blogspot.com/p/vulnerability-discl... )

- Reporting Transparency ( https://googleprojectzero.blogspot.com/p/reporting-transpare... )

Cloudflare publishes a "crawl-to-refer" ratio, which can be used to estimate the traffic from LLMs:

https://radar.cloudflare.com/ai-insights#crawl-to-refer-rati...

Do you have a link talking about those Facebook's recent tricks? I think I missed that story, and would love to read an analysis about it

It's actually 100 microyears!

If anyone else is confused, a microcentury is apparently around 52.6 minutes long.

I've updated (Firefox 138.0) and the feature doesn't seem to exist in my browser, even when carefully reproducing the steps in the video / tutorial.

From the support page: https://support.mozilla.org/en-US/kb/tab-groups

> This feature is experimental and is being introduced to the Firefox user base through a progressive rollout. It may not yet be available to all users.

I'll wait a few more days then I guess?

This sounds like good news, thanks!

Do we already have an ETA for the ENISA vulnerability database?

Announcement post: https://blog.cloudflare.com/d1-read-replication-beta/