7:30 AM UTC, and it looks like it’s been independently discovered/leaked some time ago (at least several hours). Holding the release for coordinated disclosure doesn’t seem to have worked at all.
No, a bug has been independently discovered. We don’t know if it’s the same bug. If it is, the people who discovered it don’t understand it completely. PHP core developers are saying that the proposed config change (session.upload_progress.enabled = Off) doesn’t resolve the issue and the only fix is to upgrade.
Going around on social media and claiming that it’s the same bug as what will be receiving a patch today is dangerous and leaves people with a false sense of security. From what I can tell, the only workaround before you can patch your systems is to turn off PHP.
Ignoring the fact that this post is just terrible prose for a second, it’s also wrong. It might be talking about a real bug, but the proposed config change doesn’t fix the RCE that’s being patched today.
I wonder if this is because someone was using LLMs to verify or originally discover the bug. In a talk by Greg KH I recently watched, he says LLMs demonstrably leak data to others, so projects can get hit with so-called “independently discovered” vulnerabilities in a short amount of time.
7:30 AM UTC, and it looks like it’s been independently discovered/leaked some time ago (at least several hours). Holding the release for coordinated disclosure doesn’t seem to have worked at all.
Haven’t seen a thorough explanation of the bug.
score 1 · canonical
No, a bug has been independently discovered. We don’t know if it’s the same bug. If it is, the people who discovered it don’t understand it completely. PHP core developers are saying that the proposed config change (
session.upload_progress.enabled = Off) doesn’t resolve the issue and the only fix is to upgrade.Going around on social media and claiming that it’s the same bug as what will be receiving a patch today is dangerous and leaves people with a false sense of security. From what I can tell, the only workaround before you can patch your systems is to turn off PHP.
score 1 · canonical
https://jackalsyn.com/posts/php-up-2026.html
score 1 · canonical
Ignoring the fact that this post is just terrible prose for a second, it’s also wrong. It might be talking about a real bug, but the proposed config change doesn’t fix the RCE that’s being patched today.
In short, it’s AI generated misinfo.
score 1 · canonical
Ouch, it’s uncanny to see an AI-generated exploit page with an AI-generated write-up.
score 1 · canonical
See comment above: https://lobste.rs/c/qqk3t0
Everything is moving too fast. Time to batten down the hatches, have a pint, and wait for it all to blow over.
score 2 · canonical
I wonder if this is because someone was using LLMs to verify or originally discover the bug. In a talk by Greg KH I recently watched, he says LLMs demonstrably leak data to others, so projects can get hit with so-called “independently discovered” vulnerabilities in a short amount of time.
score 1 · canonical