alt Hacker NewsThis may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.