Post

nightshade →eth0:2026
@nightshade.technology

there is a one-liner mitigation available ( session.upload_progress.enabled = 0 ) but THIS IS NOT A FIX and PHP developers have said it. IT DOES NOT RESOLVE THE ISSUE, YOU ARE STILL VULNERABLE. the only permanent solution is to patch, and EOL'd PHP versions might not receive the patch

15 reposts145 likes

TJ
@tjtjtj.tj

What does it not mitigate against? Is it just because now you have an extremely load-bearing option that could be changed back at any time by some application behavior?

TJ
@tjtjtj.tj

Oh I see. I should have read one more post down before replying lol

nightshade →eth0:2026
@nightshade.technology

to be clear the reason this is not a patch is because this mega-vuln is actually TWO mega-CVEs and this only "resolves" one of them (i think). we still have to wait and see for full detais but... yeah

mlf. ⎔
@mlf.one

both the jacksalyn and 19h "poc"s fall apart under scrutiny tho - the jacksalyn one claims UAF but reading the PHP code shows the progress tree never actually dies, while the 19h one specifically requires a specific, deliberately nonstandard, config to reproduce according to the author

mlf. ⎔
@mlf.one

none of the published sources have yet to actually put out a valgrind or asan trace that proves UAF, yet they both claim to have found such.

TJ
@tjtjtj.tj

This seems like a strange decision to me. Normally I would agree with maintainers to hold strong on EOL, but something this bad has the potential to cause a major clusterfuck with the Internet at large. Do we have an estimate for how many active PHP <8 installs there are?