PHP to release patches for two critical vulnerabilities rated 9.2, experts warn against relying on session.upload_progress setting

PHP plans to release patches for two critical vulnerabilities, each rated 9.2 out of 10, at 14:00 UTC on October 21. The updates will cover the supported PHP branches 8.2 through 8.5, with details on affected versions and mitigations to be published alongside the release. No attacks have been reported so far, and PHP has not disclosed which part of the code is vulnerable or which settings might affect risk.

A configuration change that has been circulating as a workaround—setting session.upload_progress.enabled=0 to disable the Session Upload Progress feature—does not provide complete protection. GMO Flatt Security, which initially suggested the change, later clarified that attacks could bypass it and that the setting should not be counted on as a fix. PHP core developer Gina Peter Banyard echoed this view, stating that the only reliable mitigation is to apply the official patch.

Administrators are advised to reduce exposure by moving vulnerable PHP instances off the public internet, applying access controls, and preparing update procedures in advance. If immediate patching is not possible, CERT-EU recommends isolating internet-facing applications, using VPNs or allow-lists, and limiting the server’s privileges and stored credentials. Older, unsupported PHP versions (including 8.1, 7.x, and 5.x) will not receive fixes and should be upgraded or taken offline.

Web application firewalls may offer limited protection, but they are not a substitute for the patch. Hosting providers and managed services should be contacted to confirm when a fixed PHP build will be available. After the patches are applied, operators should verify the updated version, review logs for any pre-patch activity, and ensure that any remaining configuration settings are correctly applied.