PHP Issues Advisory for New Web Server Security Vulnerability
Summary
PHP has issued an advisory after a new security vulnerability was discovered that could allow unauthorized code execution on web servers. The company recommends disabling session.upload_progress.enabled until a regular bugfix update is released.
Key Points
- PHP warned that a new vulnerability can allow unauthorized code to run on affected web servers.
- The recommended mitigation is to set session.upload_progress.enabled=0 until the next regular bugfix update arrives.
- The issue only appears under a rare combination of specific configurations and runtime application behavior.
- PHP said the problem will be fixed in a regular update rather than an emergency release.
