POC Released for Critical Pre-Auth RCE in PHP session.upload_progress
A researcher disclosed two critical pre-auth RCE flaws (CVSS 9.2) in PHP's session.uploadprogress handler via the php2shell project, and the POC has leaked early. Researchers warn mitigations alone may not suffice and urge exposed servers to patch promptly.
2026-10-21 ~ 2026-10-21 · 2 related posts
- Episode 1: PHP2Shell: Emergency patches released for two critical pre-auth PHP RCE flaws(2026-10-21, 26 posts)
- Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
- Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
- Episode 4: POC Released for Critical Pre-Auth RCE in PHP session.upload_progress(2026-10-21, 2 posts)
- Episode 5: PHP warns of two critical CVSS 9.2 flaws as emergency patches ship(2026-10-21, 3 posts)
- php2shell POC Leaked Early: Mitigation Alone May Not Be Enough, Patch PHP Now — basedjensen · 2026-10-21
- php2shell: Critical PHP session.upload_progress pre-auth RCE bugs (CVSS 9.2) get public POCs — jedisct1 · 2026-10-21