I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.
I guess the future is people arguing in comments whether a high-severity vulnerability is the one under embargo, or one of various unrelated devastating bugs discovered when people got wind of the embargo and pointed their AI agents at the codebase.
How is this a better source, the current post is a PoC? This is just a warning...
You're not even reading the things you're saying are worse, and reccomending things that arent what you say they are (because you didnt read those either)
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch :
if ($http_content_type ~* "multipart") {
return 403;
}
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases :
session.upload_progress.enabled = Off
It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.
This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.
But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.
Any idea if Cloudflare in front of an unpatched site would prevent this? They did 2 updates already today to their managed rulesets but are not specifying what.
"Cloudflare has protections in place for known exploit payloads. There will be more variations to come and the only way to fully protect your site is to update php once released."
I think putting my PHP site behind Cloudflare would be the least I would do if I wanted to keep it online before PHP can be patched. The other alternative is trying to block multi-part uploads before they reach PHP.
Make sure to create CF tunnel to your server and to reject all traffic frin other sources, or to accept traffic only from known CF ips. Otherwise, you're still exposed, even if CF WAF works.
It is visually interesting but also annoying. I hate to
admit it, but as I grow older, I may get dumber and I
much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages
have not yet all fixed existing bugs. Has not AI been used
to find bugs or assumed bugs? Why are bugs found in old
code still?
Why would they hand code a website for an exploit that they probably found 15 minutes before and will be fixed in a few hours? The copy should have been better though.
Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.
It may have made sense when finding exploits required some skill and time so 24 hours would be safe enough but now when anyone can just point an LLM at it...
The POC was already out on Sunday apparently. When they announced it they made everyone go looking for it. In the before times even someone with decent cybersecurity and hacking experience might not be able to weaponize a POC. Today anyone can weaponize it immediately.
I just wrote almost the same thing (I start to write my
comments before I read what others say, so that it is not
influenced directly what I write). I am glad to come to the
same conclusion - this website is both visually interesting
as well as very annoying.
It's things like "under the attacker's feet" which completely throw me off. While trying to parse the text, my brain tries to imagine a surprised hacker.
Yeah but this AI music is worse than any AI produced code. They're both awful but I really lose all respect for people who think these Sumo songs sound good. Wow I hate that AI musician voice so much.
I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.
Ctrl-Alt-R for reader view in Firefox, not that it makes the whole thing much more interesting to look at - we'll forget about it all soon enough anyway. Don't forget to tweak the default settings for reader view for a better experience.
Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design, especially in older versions. It also has CVE-2026-109618, a type of vulnerability many languages aren’t even capable of having (since it wouldn’t be part of the language, and the library that implemented the equivalent would only be present when necessary and usually not written in C - with some exceptions).
> but a lot of it is legitimately terrible language[1] and API design
Unlike well-thought-out languages like JavaScript, of course.
What's the saying? A programming language is either bad, or no one uses it. Discussions about flavors of bad in well-established programming languages are a waste of time.
unfortunately php is mosty ...insert forum here...
hell even vanilla xenforo was getting compromised all the time, sure there's smaller frameworks and various government institutions using php, but it has many of the same downfalls that mixing server and client code has, the worst offender that comes to mind that enabled many of these bad practices is next.js
I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.
Which is also what tfa says btw
I guess the future is people arguing in comments whether a high-severity vulnerability is the one under embargo, or one of various unrelated devastating bugs discovered when people got wind of the embargo and pointed their AI agents at the codebase.
the future is now, eh.
I turned the server off on our app until this storm is over.
Yeah, the circuit breaker is the best firewall!
Someone uses Claude to role play as a hacker... Yikes
Previously submitted with a much better source: https://news.ycombinator.com/item?id=50172041
This one claims to actually be an exploit. The other was an announcement from PHP without details.
How is this a better source, the current post is a PoC? This is just a warning...
You're not even reading the things you're saying are worse, and reccomending things that arent what you say they are (because you didnt read those either)
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
After digging a little in the PoC code (here https://jackalsyn.com/posts/php-up-2026.html) I'm quite confident it's not a completely working one.
It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.
This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.
But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.
If I have a PHP site that doesn't require uploads, how exactly do I disable enough of multipart/form-data POST handling in PHP to mitigate this?
Block it at your web server before it reaches PHP. Ctrl+F "nginx" or ".htaccess" in this thread for configs.
Got it, thank you!
Any idea if Cloudflare in front of an unpatched site would prevent this? They did 2 updates already today to their managed rulesets but are not specifying what.
https://developers.cloudflare.com/waf/change-log/changelog/
https://x.com/dok2001/status/2112702593705312467
"We got you covered" - Dane Knecht (Cloudflare CTO)
A little too vague for my comfort.
Now deleted, and replaced with: https://x.com/dok2001/status/2112802620029223193
"Cloudflare has protections in place for known exploit payloads. There will be more variations to come and the only way to fully protect your site is to update php once released."
I think putting my PHP site behind Cloudflare would be the least I would do if I wanted to keep it online before PHP can be patched. The other alternative is trying to block multi-part uploads before they reach PHP.
Make sure to create CF tunnel to your server and to reject all traffic frin other sources, or to accept traffic only from known CF ips. Otherwise, you're still exposed, even if CF WAF works.
CF in front can mess about with L7?
Yes? How did you think Cloudflare and other WAFs worked?
A WAF is primarily working at L7.
https://github.com/consocio/php2shell-audit/ GLM 5.3 just wrote it to audit all my php sites. I hope it is useful to you
reply
"Posting, captcha, sign-in and other dynamic pages are offline while we apply an urgent PHP security update" - https://4chan.org/
Can anyone get the sha to match the download? (Given as a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 in TFA)
Disabled everything except GET requests and hope it holds until 2pm
It’s use-after-free where the “use” is execution of arbitrary code. Yeah, that’s pretty bad.
.htaccess
This appears to have global effect if placed in a <Location> block in the root apache2.conf:
What about servers that run PHP from the Debian repos?
How fast will the repos be updated?
On Reddit they stated that Ondrej is aware of the issue
That website looks weird - was it AI coded?
It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?
Why would they hand code a website for an exploit that they probably found 15 minutes before and will be fixed in a few hours? The copy should have been better though.
Well Heartbleed and Shellshock had nice looking sites so we kindoff expect better?
They had more time to prepare
Because it takes less effort to paste text with basic readable formatting than doing this awfulness
Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.
It may have made sense when finding exploits required some skill and time so 24 hours would be safe enough but now when anyone can just point an LLM at it...
The POC was already out on Sunday apparently. When they announced it they made everyone go looking for it. In the before times even someone with decent cybersecurity and hacking experience might not be able to weaponize a POC. Today anyone can weaponize it immediately.
That's pure unreviewed slop
The text of this is basically unreadable, any amount of human authorship would be better.
yeah agreed.
I just wrote almost the same thing (I start to write my comments before I read what others say, so that it is not influenced directly what I write). I am glad to come to the same conclusion - this website is both visually interesting as well as very annoying.
It's things like "under the attacker's feet" which completely throw me off. While trying to parse the text, my brain tries to imagine a surprised hacker.
LLM or Engrish? Reminds me of “thumb rule”.
The font is terrible on mobile, cannot tell then difference between a comma and a fullstop at all
It reads like the average PR summary I had to review every day. ‘Had’, because I stopped doing that after being blessed by LGTM https://m.youtube.com/watch?v=3TNpOD6bov8&pp=ygUEbGd0bQ%3D%3...
Yeah but this AI music is worse than any AI produced code. They're both awful but I really lose all respect for people who think these Sumo songs sound good. Wow I hate that AI musician voice so much.
It really reads like it was passed 3 times through Claude.
I'd say pass through any other AI that doesn't talk like someone filled with self-importance
I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.
Ctrl-Alt-R for reader view in Firefox, not that it makes the whole thing much more interesting to look at - we'll forget about it all soon enough anyway. Don't forget to tweak the default settings for reader view for a better experience.
>Steal Everything
>Leave Nothing
Cringe larping skiddie nonsense
Man, my experience with php was never good. Every php project I've encountered eventually had a monero miner infecting the machine as www-data user.
Maybe that’s because you’ve only worked with WordPress with tons of unpatched plugins.
Every programming language has security vulnerabilities. PHP doesn’t have any more than others.
> PHP doesn’t have any more than others.
Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design, especially in older versions. It also has CVE-2026-109618, a type of vulnerability many languages aren’t even capable of having (since it wouldn’t be part of the language, and the library that implemented the equivalent would only be present when necessary and usually not written in C - with some exceptions).
[1] People have already covered this in depth, but here’s a lesser-mentioned taste: https://web.archive.org/web/20261017012819/https://www.php.n... (one section, btw)
> but a lot of it is legitimately terrible language[1] and API design
Unlike well-thought-out languages like JavaScript, of course.
What's the saying? A programming language is either bad, or no one uses it. Discussions about flavors of bad in well-established programming languages are a waste of time.
unfortunately php is mosty ...insert forum here...
hell even vanilla xenforo was getting compromised all the time, sure there's smaller frameworks and various government institutions using php, but it has many of the same downfalls that mixing server and client code has, the worst offender that comes to mind that enabled many of these bad practices is next.js