A trusted contact who has a working exploit tells me reliable exploitation is still possible against PHP 8.2.35 and 8.5.12, despite the security updates. According to their testing, setting session.upload_progress.enabled = Off blocks that exploit path. I haven’t reproduced this myself. Whether this is an incomplete fix for the disclosed CVEs or a separate issue still needs clarification.

Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now: process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage. And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability. From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes. It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process. Quick start: github.com/Neo23x0/process-w… Project: github.com/Neo23x0/process-w…