Comment by lioeters

This vulnerability has already been reproduced by a third party with LLM assist. And of course they posted the details on Twitter - and someone else posted the link here just now. So the cat's out of the bag.

That means roughly 70% of all websites (WordPress, Laravel, Drupal, Joomla, Magento) are currently open to remote code execution. About half of that is running an older PHP 5 and 7 that apparently will not receive the urgent security patch.

> Two heap use-after-free primitives in PHP's `session.upload_progress` handler

Guess it's time to rewrite PHP in Rust. Claude, make no mistakes, you can do it!