Brian

‼️BREAKING: Security firm Calif appears to have a working exploit for the leaked PHP flaws, hours before the patch. A briefly posted video credited to Calif shows it running commands on a WordPress 7.1.3 site on PHP 8.5.4. Kevin Beaumont says a screenshot from it is real. A separate public PoC is also circulating, but its own author now says one of its attack chains is dead and code execution is unreliable. Admins have two stopgaps until the fix lands at 14:00 UTC today. Turning off session.upload_progress.enabled in php.ini disables the feature the leaked details point to. The only cost is upload progress bars. Blocking every request with a multipart Content-Type at the web server goes further, but breaks file uploads. Neither is official. Gina Peter Banyard, a PHP core developer at the PHP Foundation, says "the only mitigation is patching / upgrading PHP." If you can afford to switch a server off for a day, she says, that might be the most sensible thing to do. "I sadly know too much," she wrote.