Birbla

Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

196 pointsby petecooper63 comments

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Two things you can do now:

    1. Turn off session upload progress

    2. Block multipart requests at the web server

    More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...

    by vincent_s
  • This was supposed to be embargoed.

    So your reliable source can't keep a secret.

    by unreal37
  • Looks like details about the exploits have already leaked on twitter, if the info is correct then it can be mitigated by setting session.upload_progress.enabled = Off until you get the opportunity to update
    by potaytopotahto
  • Rumored mitigation from other HN threads:

    >Mitigation for impacted versions is to set `session.upload_progress.enabled = Off` in php.ini

    It's a feature my wiki doesn't use, so even though I'm patching ASAP it did me no harm in flipping that bit. In fact, I could probably just shut down my server for the day...

    edit: I simply shut down my dokuwiki for the day. No one uses it but me anyway.

    edit2: https://old.reddit.com/r/PHP/comments/1xb2utu/upcoming_criti...

    Someone claiming to be a releng for PHP says INI settings won't save you.

    by unethical_ban
  • Tweet allegedly showing exploit at work:

    https://x.com/k_firsov/status/2112641845926989944

    (video). Yikes

    by phab
  • Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.
    by samueloph
  • @dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.

    CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.

    Speculation is that the affected subsystem runs before any application code and affects all default installs.

    by devttyeu
  • There comes at point at which it is better for everyone to just disclose the details and pursue Full Disclosure. I think we reached that point hours ago.

    It has been incredibly frustrating watching Twitter and that (potentially, I don't know how reliable the leaks are) being a better information source than anything else, at least so that those of us hosting stuff ourselves can try and explore if there are any defensive measures that can be put in place in lieu of any actual fixed builds being released.

    I suspect this is already being actively exploited now.

    https://x.com/J4ck3LSyN/status/2112703096443097263

    They've now posted a proof of concept as well.

    by lol768

Explore Birbla archives