proxy

myemdash.com/ | https://news.ycombinator.com/item?id=50180254 | 0 comments 1792589908 | Check/probe tool for PHP CVE-2026-109618/619 | https://php2shell.site/news.ycombinator.com/11c22360e8df83b4 | https://news.ycombinator.com/item?id=50180769 | 0 comments 1792589952 | PHP patches have been released | https://www.php.net/archive/2026.php | https://news.ycombinator.com/item?id=50180783 | 0 comments 1792590090 | Simple Proxy to secure your PHP from vulnerability CVE-2026-109618 | https://github.com/Qbix/proxy | https://news.ycombinator.com/item?id=50180810 | 0 comments 1792590108 | PHP Security advisory: Critical remote code execution vulnerabilities | https://www.php.net/archive/2026.php | https://news.ycombinator.com/item?id=50180818 | 0 comments

main/SAPI.c#L162 The article linked from your own README (https://sansec.io/research/php2shell) has a better partial mitigation in existing, battle-tested reverse proxies. Even still, as that article says, everything here is a partial mitigation. The description of the issues in your project's README is an inaccurate understatement of the severity of the issues. "CVE-2026-109618 — heap use-after-free in the session.upload_progress handler" is an incomplete understatement of the issue, the session.upload_progress handler is only one of a number of potential exploitation paths. https://github.com/php/php-src/security/advisories/GHSA-w8hw... has some hints at other paths, of which there are many. From an LLM, and quickly validated by me, a heap overflow, likely an RCE. > src/http.c:101-116 and src/util.c:9 Attacker supplied value in strtoul, the size-limit checks are unsigned addition that can wrap, and you can follow the chain from there. > or better yet submit a request. This project is not deserving of fixing, it should just be deleted and direct people to more serious documentation of fixes and mitigations. This code is clearly AI-generated slop, it is not my responsibility to fix your project. > I could understand if you actually at least clicked and looked at the repository, and read what it’s about. But you chose to simply write generic text without looking at anything. You want to discourage people from protecting their servers, in order to feel good about yourself. What amount of effort have you put into understanding what you’re even talking about? Every accusation is an admission.