Comment by vincent_s
20 hours ago
Two things you can do now:
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
20 hours ago
Two things you can do now:
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
Or:
3. Disable PHP entirely on your server, and live with broken sites until the patch arrives.
That's what I did; I can live with my sites being down until it's possible to patch PHP. Though, there are likely others who cannot. The CERT-EU advisory is basically advising the same thing[1].
[1] https://cert.europa.eu/publications/security-advisories/2026...
I maintain one old site in PHP. This just got way easier to communicate with my users when I can communicate that major government services are also offline.
Our current plan is to refactor this into Rust using a coding agent. It looks feasible to get this done today.