PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

80fj0348i

Previously submitted with a much better source: https://news.ycombinator.com/item?id=50172041

drum55

The text of this is basically unreadable, any amount of human authorship would be better.

shevy-java

That website looks weird - was it AI coded? It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times. As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?

iambateman

I turned the server off on our app until this storm is over.

himata4113

Man, my experience with php was never good. Every php project I've encountered eventually had a monero miner infecting the machine as www-data user.

lionkor

Someone uses Claude to role play as a hacker... Yikes

InvisibleUp

This is, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001 . Seems the best stopgap is SELinux or AppArmor.

TekMol

What about servers that run PHP from the Debian repos? How fast will the repos be updated?

viccis

>Steal Everything >Leave Nothing Cringe larping skiddie nonsense

6510

.htaccess <If "req('Content-Type') =~ /multipart/i"> Require all denied </If>

synack

It’s use-after-free where the “use” is execution of arbitrary code. Yeah, that’s pretty bad.

lorenzbrun

I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.

e12e

Can anyone get the sha to match the download? (Given as a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 in TFA)