TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A researcher’s Oct. 21 correction says the alleged cached-pointer exploit in PHP session.upload_progress is prevented by a reference-count increment, and does not provide code execution. The report identifies a separate cross-request use-after-free in serialization state, rated CVSS 5.3 by the researcher, with testing indicating a prefork-specific memory-safety issue; official PHP confirmation and patch details are not included in the supplied material.
A security researcher corrected a report on Oct. 21 about PHP’s session.upload_progress handler, saying the originally described cached-pointer exploit is stopped by a reference-count check and does not enable code execution. The researcher says a separate cross-request use-after-free remains in serialization state on prefork PHP deployments; the report rates that issue CVSS 5.3 and describes it as a memory-safety flaw, not remote code execution.
The correction distinguishes two paths that the original report had linked. In the first, labeled the cached-pointer path and associated with CVE-2026-109618, a session handler could appear to reuse a stale pointer after a memory-limit failure. But the researcher says PHP’s Z_TRY_ADDREF check at session.c:3213 keeps the relevant array alive, blocking the proposed free-and-reuse chain. The researcher revised that path’s severity to CVSS 0.0 and said it does not provide a working exploit.
The researcher identifies the other issue, associated with CVE-2026-109619, as a serialization-state use-after-free across requests handled by the same process. According to the report, a memory-limit bailout during upload-progress processing can leave serialization context in a stale state before PHP’s basic-functions request initialization resets it. A later request may then reuse that context. The report cites an AddressSanitizer finding at var.c:756 and says the confirmed impact is memory corruption or a process crash, not code execution.
The reported tests used Apache 2.4.68 with mod_php 8.2.34 on Debian 12, with an 8 MB memory limit, alongside other test setups. The researcher says the serialization-state issue was reproduced in a prefork environment, while it was not reproduced on LiteSpeed LSAPI, where the worker exits at request initialization. Reliable reproduction reportedly depends on build-specific heap layout. These are researcher-reported validation results; the supplied material does not include an official PHP security advisory confirming the findings.
Why the Prefork Finding Matters
The correction matters because the initial exploit framing and the revised finding imply very different risks. The researcher now says the cached-pointer route is not exploitable as described, while the separate issue is a narrower memory-safety flaw in prefork deployments. That distinction helps administrators avoid treating the report as evidence of a confirmed remote-code-execution vulnerability.
A cross-request flaw can still matter to operators: if a process retains damaged state between requests, a subsequent request may trigger a crash or other memory corruption. The report does not establish that the behavior can be turned into code execution, nor does it provide independent confirmation of real-world exploitation. For defenders, the practical priority is to verify exposure, watch for official vendor guidance, and treat the proposed configuration change as a researcher-recommended precaution rather than a published PHP fix.
As an affiliate, we earn on qualifying purchases.
How Upload Progress Enters the Request
PHP’s session.upload_progress feature tracks progress for multipart file uploads. The report focuses on its handler in ext/session/session.c and its position in request processing: the handler runs during environment setup, before the basic-functions request initialization that normally resets serialization and unserialization globals. The researcher’s proposed cause is that a memory-limit bailout in this interval can leave context state behind for a later request handled by the same process.
The report’s Oct. 21 revision explicitly supersedes its earlier cached-pointer explanation. It says an increment of the array’s reference count prevents the free required for that chain. The researcher lists PHP versions 8.2.34, 8.3.35, 8.4.26 and 8.5.11 as current stable releases in the mitigation notes, but the supplied material does not say whether those releases contain a fix. Those version numbers should not be read as confirmation that a patch has been issued.
“Cached-pointer chain DEAD at the addref … The real bug is a serialize-state cross-request UAF.”
— The researcher’s corrected findings, dated Oct. 21, 2026
web application memory safety tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Report Does Not Establish
The supplied source is an individual researcher’s report, not an official PHP advisory. It does not establish that PHP maintainers have confirmed the flaw, assigned or finalized the two CVE identifiers, or published a patch. Although the researcher reports an AddressSanitizer finding and repeated process crashes, independent validation and affected-version boundaries are not provided here.
The report also says an attempted proof for the remaining issue was blocked by session-global corruption that prevented clean decoding of attacker-controlled session data. It therefore does not show a completed exploit chain for that path. The exact conditions required for reliable triggering, exposure outside the tested prefork setup, and whether any crash can be escalated beyond denial of service remain unclear.
As an affiliate, we earn on qualifying purchases.
Vendor Guidance and Patch Status
The researcher says they plan to follow up when an official advisory is published and to revisit the root-cause analysis. Administrators should check PHP’s official security announcements and their distribution or hosting provider for affected-version guidance and patched packages; the supplied report does not identify a release containing a fix.
As a temporary measure, the researcher recommends setting session.upload_progress.enabled = Off and reloading PHP-FPM or the web server. The report also suggests reviewing multipart upload exposure at the reverse proxy or web-application firewall, but does not establish that this step addresses the serialization-state flaw in every configuration. Operators should weigh those suggestions against application requirements and replace interim mitigations with vendor guidance when it becomes available.
PHP session management debugging tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does the report describe remote code execution?
No. The researcher’s correction says the cached-pointer path is blocked by a reference-count increment and assigns it CVSS 0.0. The separate serialization-state flaw is described as a memory-safety issue, not code execution.
What is the remaining reported vulnerability?
The researcher describes a cross-request use-after-free in PHP serialization state, associated in the report with CVE-2026-109619. It is reported in prefork testing and rated CVSS 5.3, but the supplied material does not include official PHP confirmation.
Which PHP configurations were tested?
The report describes testing on Apache with mod_php in prefork mode, including PHP 8.2.34 on Debian 12. It says the issue was not reproduced on LiteSpeed LSAPI, where the worker exits at request initialization; this does not establish that all other configurations are unaffected.
What temporary step does the researcher recommend?
The report recommends disabling upload-progress tracking with session.upload_progress.enabled = Off, then reloading PHP-FPM or the web server. This is researcher guidance, not an official PHP mitigation notice.
Has PHP released a fix?
The supplied material does not confirm a PHP advisory or a patched release. Administrators should check official PHP and package-provider announcements for current status.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
