@whitequark@social.treehouse.systems
2026-10-21 01:44 UTC
btw you might be able to patch the PHP vuln with session.upload_progress.enabled = off
source: https://x.com/J4ck3LSyN/status/2112703096443097263 (i don't give a fuck about the embargo, i need to defend things)
edit: see boost below, this is not actually enough according to a php core dev
Replies (2)
-
@Girgias@phpc.social 2026-10-21 02:13
@whitequark@social.treehouse.systems The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.
-
@demize@unstable.systems 2026-10-21 02:07
@whitequark@social.treehouse.systems what should be an ice cold take: if independent third parties can recreate the exploit (like i think happened in that tweet) from non-embargoed information, the embargo can only do more harm than good