SmackerNews

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

jackalsyn.com/posts/php-up-2026.html

187 points · 62 comments · 4 days ago · rfarley04

lorenzbrun4 days ago
I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
InvisibleUp4 days ago
This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
idlewords4 days ago
I guess the future is people arguing in comments whether a high-severity vulnerability is the one under embargo, or one of various unrelated devastating bugs discovered when people got wind of the embargo and pointed their AI agents at the codebase.
lionkor4 days ago
Someone uses Claude to role play as a hacker... Yikes
iambateman4 days ago
I turned the server off on our app until this storm is over.
80fj0348i4 days ago
Previously submitted with a much better source: https://smackernews.com/item/50172041 HN

.htaccess

    <If "req('Content-Type') =~ /multipart/i">
        Require all denied
    </If>

Mooty4 days ago
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
shevy-java4 days ago
That website looks weird - was it AI coded?
It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?
dataflow4 days ago
If I have a PHP site that doesn't require uploads, how exactly do I disable enough of multipart/form-data POST handling in PHP to mitigate this?
ffritz4 days ago
Any idea if Cloudflare in front of an unpatched site would prevent this? They did 2 updates already today to their managed rulesets but are not specifying what.
https://developers.cloudflare.com/waf/change-log/changelog/
nilslindemann4 days ago
"Posting, captcha, sign-in and other dynamic pages are offline while we apply an urgent PHP security update" - https://4chan.org/
e12e4 days ago
Can anyone get the sha to match the download? (Given as a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 in TFA)
synack4 days ago
It’s use-after-free where the “use” is execution of arbitrary code. Yeah, that’s pretty bad.
TekMol4 days ago
What about servers that run PHP from the Debian repos?
How fast will the repos be updated?
hemlock45934 days ago
Disabled everything except GET requests and hope it holds until 2pm
hparadiz4 days ago
Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.
nargek4 days ago
That's pure unreviewed slop
drum554 days ago
The text of this is basically unreadable, any amount of human authorship would be better.
fwlr4 days ago
I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.
viccis4 days ago
Steal Everything
Leave Nothing
Cringe larping skiddie nonsense
himata41134 days ago
Man, my experience with php was never good. Every php project I've encountered eventually had a monero miner infecting the machine as www-data user.

news.ycombinator.com/item?id=50176077

SmackerNews

A placeholder title for loading skeleton

example.com/path/to/article

000 points · username · 0 hours ago

example.com

SmackerNews

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

jackalsyn.com/posts/php-up-2026.html

187 points · 62 comments · 4 days ago · rfarley04

jackalsyn.com/posts

lorenzbrun4 days ago
I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
InvisibleUp4 days ago
This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
idlewords4 days ago
I guess the future is people arguing in comments whether a high-severity vulnerability is the one under embargo, or one of various unrelated devastating bugs discovered when people got wind of the embargo and pointed their AI agents at the codebase.
lionkor4 days ago
Someone uses Claude to role play as a hacker... Yikes
iambateman4 days ago
I turned the server off on our app until this storm is over.
80fj0348i4 days ago
Previously submitted with a much better source: https://smackernews.com/item/50172041 HN

65104 days ago

.htaccess

    <If "req('Content-Type') =~ /multipart/i">
        Require all denied
    </If>

Mooty4 days ago
If you use Nginx, you can temporarly block the subject by disallowing multipart sendings to PHP. This is quite a problem for a lot of forms, but way better that being hacked.
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
shevy-java4 days ago
That website looks weird - was it AI coded?
It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?
dataflow4 days ago
If I have a PHP site that doesn't require uploads, how exactly do I disable enough of multipart/form-data POST handling in PHP to mitigate this?
ffritz4 days ago
Any idea if Cloudflare in front of an unpatched site would prevent this? They did 2 updates already today to their managed rulesets but are not specifying what.
https://developers.cloudflare.com/waf/change-log/changelog/
nilslindemann4 days ago
"Posting, captcha, sign-in and other dynamic pages are offline while we apply an urgent PHP security update" - https://4chan.org/
e12e4 days ago
Can anyone get the sha to match the download? (Given as a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 in TFA)
synack4 days ago
It’s use-after-free where the “use” is execution of arbitrary code. Yeah, that’s pretty bad.
TekMol4 days ago
What about servers that run PHP from the Debian repos?
How fast will the repos be updated?
hemlock45934 days ago
Disabled everything except GET requests and hope it holds until 2pm
hparadiz4 days ago
Announcing this thing and then putting an embargo on the fix for 24 hours is by far the most irresponsible thing internals has ever done and I have seen them do some insane shit in the past 20 years.
nargek4 days ago
That's pure unreviewed slop
drum554 days ago
The text of this is basically unreadable, any amount of human authorship would be better.
fwlr4 days ago
I can literally feel my eyes physically defocusing trying to read this, and I can’t help but conclude that, at a level below conscious thought, my brain is trying to defend itself from AI-generated text. Perhaps it is more of a cognitopoison than I explicitly knew.
viccis4 days ago
Steal Everything
Leave Nothing
Cringe larping skiddie nonsense
himata41134 days ago
Man, my experience with php was never good. Every php project I've encountered eventually had a monero miner infecting the machine as www-data user.

news.ycombinator.com/item?id=50176077