PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

The text of this is basically unreadable, any amount of human authorship would be better.

I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.

I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.

This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.

If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.

Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }

You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off

Previously submitted with a much better source: https://news.ycombinator.com/item?id=50172041

Someone uses Claude to role play as a hacker... Yikes

If I have a PHP site that doesn't require uploads, how exactly do I disable enough of multipart/form-data POST handling in PHP to mitigate this?

I turned the server off on our app until this storm is over.

Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.

Can anyone get the sha to match the download? (Given as a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 in TFA)

Man, my experience with php was never good. Every php project I've encountered eventually had a monero miner infecting the machine as www-data user.

It’s use-after-free where the “use” is execution of arbitrary code. Yeah, that’s pretty bad.

.htaccess

<If "req('Content-Type') =~ /multipart/i"> Require all denied </If>

What about servers that run PHP from the Debian repos?

How fast will the repos be updated?

That website looks weird - was it AI coded?

It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.

As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?

>Steal Everything

>Leave Nothing

Cringe larping skiddie nonsense