You're not even reading the things you're saying are worse, and reccomending things that arent what you say they are (because you didnt read those either)
Here is an Nginx patch : if ($http_content_type ~* "multipart") { return 403; }
You can also turn of session progress in php.ini as mentionned but that does not seem to cover every cases : session.upload_progress.enabled = Off
It assumes PHP frees the upload progress data when it reloads the session. But PHP 8.4 (the one we use is 8.4.24, i don't know for other versions) calls Z_TRY_ADDREF(progress->data) to keep that data alive. The fake function call also seems to contain invalid fields.
This makes me question this particular PoC, not the official PHP security warning. I have not reproduced the exploit, so this is a concern based on reading the code, not proof that the real vulnerabilities cannot be exploited.
But anyway the CVE still exists, and the exploitation is tied to multipart, disabling it seems the best thing you can do now without shutting everything down.
"We got you covered" - Dane Knecht (Cloudflare CTO)
"Cloudflare has protections in place for known exploit payloads. There will be more variations to come and the only way to fully protect your site is to update php once released."
<If "req('Content-Type') =~ /multipart/i">
Require all denied
</If> # PHP 20261020 Remediation (Global)
<Location />
<If "req('Content-Type') =~ /multipart/i">
Require all denied
</If>
</Location>It is visually interesting but also annoying. I hate to admit it, but as I grow older, I may get dumber and I much prefer simplicity at all times.
As for PHP: it also is a bit weird how programming languages have not yet all fixed existing bugs. Has not AI been used to find bugs or assumed bugs? Why are bugs found in old code still?
Every programming language has security vulnerabilities. PHP doesn’t have any more than others.
Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design, especially in older versions. It also has CVE-2026-109618, a type of vulnerability many languages aren’t even capable of having (since it wouldn’t be part of the language, and the library that implemented the equivalent would only be present when necessary and usually not written in C - with some exceptions).
[1] People have already covered this in depth, but here’s a lesser-mentioned taste: https://web.archive.org/web/20261017012819/https://www.php.n... (one section, btw)
Unlike well-thought-out languages like JavaScript, of course.
What's the saying? A programming language is either bad, or no one uses it. Discussions about flavors of bad in well-established programming languages are a waste of time.