A PHP session.upload_progress use-after-free lets attackers reach system() with stock settings
Major PHP Vulnerability Leaked
A heap use-after-free in PHP's session.upload_progress handler caches two raw zval bucket pointers that the request lifecycle frees, letting a stale pointer land an attacker-shaped zend_fcall_info that calls zend_call_function — effectively system(). Verified against php-src 8.4.4 and 8.2.34, it works on default configuration. The author publishes a full PoC framework, per-build symbol deltas, and pre-patch mitigations for free.
A pre-patch mitigation shouldn't be a subscription perk.
- lorenzbrun
I'm pretty sure this is not the vulnerability that's still officially under embargo. I think I found the the two actual vulnerabilities (both UAFs and similar). I patched my own stuff (at least I hope so) and am mirroring traffic to a detector, very interested to see when I get the first hits. Unless I see actual exploit attempts or a full leak I think I'm not going to publish my patches yet.
- InvisibleUp
This may be, according to one of the PHP devs, a completely unrelated exploit. See https://phpc.social/@Girgias/117476477429221001. Seems the best stopgap is SELinux or AppArmor.
- idlewords
I guess the future is people arguing in comments whether a high-severity vulnerability is the one under embargo, or one of various unrelated devastating bugs discovered when people got wind of the embargo and pointed their AI agents at the codebase.
- iambateman
I turned the server off on our app until this storm is over.
- lionkor
Someone uses Claude to role play as a hacker... Yikes