Comment by vincent_s
20 hours ago
Two things you can do now:
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
20 hours ago
Two things you can do now:
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
If you can afford it, shut down your PHP apps now until the patch is out.
PHP core maintainers themselves have said that only upgrading PHP will be sufficient: https://phpc.social/@Girgias/117476477429221001
That's why I suggested blocking requests at the web server level so they don't even reach PHP.
>multipart requests
is this multipart request smuggling again?
I think I see a way to overwrite suitable memory in the parser, so smuggling (as in: confusing another parser) would be purely for bonus points.