PHP session upload-progress use-after-free posted before a patch
Original title: Major PHP Vulnerability Leaked
The author publishes a public framework and says stock PHP 8.2.34 and 8.4.4 can reach code execution.
A researcher describes a heap use-after-free in PHP's session.upload_progress handler and says a crafted multipart request can lead to a call of an attacker-controlled function. The post says the issue was checked on PHP 8.4.4 and 8.2.34 and that default upload-progress settings are enough. No CVE or official advisory is named. Suggested interim steps are disabling upload-progress tracking, limiting multipart posts, and patching when a fix ships.
Unconfirmed: The author says the root-cause reading awaits confirmation when an official advisory publishes.
- Author says PHP 7.x and older will not receive a fix.
- Stopgap is session.upload_progress.enabled set to Off, then reload PHP.
- Author says a second path remains in the multipart parser regardless of that setting.
- Named researchers are Andrew Dorman and Arch&Yuki; no vendor advisory is cited.
Impact: remote code execution via a heap use-after-free
| Product | Affected |
|---|---|
| PHP Group PHP | 8.4.4 and 8.2.34, author-verified |
- 1.Set session.upload_progress.enabled to Off and reload PHP.
- 2.Inventory hosts, including PHP 7.x, which the author says will not be fixed.
- 3.Restrict or rate-limit multipart POSTs at a WAF or reverse proxy.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 | ts/php-up-2026.tar.gz tar -xzf php-up-2026.tar.gz hash(256) a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017 Credits: author @J4ck3LSyN research Andrew Dorman (@acd421) |
From the original article
3 min read at jackalsyn.comTwo cached bucket pointers, one freed tree. A heap use-after-free in PHP session. upload_progress reaching zend_call_function.
By rfarley04 · jackalsyn.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.