Wrong day to setup another #wordpress #blog #php https://wordpress.labb.sunet.se/
0 Boosts
0 Likes
@woozle
The PHP engine parses the request that contains uploaded files and hits the bug. This happens long before your application code runs and tries to handle that request. So no, you are not safe.
@woozle how do you disallow public uploads? To my knowledge (which is only from reading blogs), it's enough to send a malicious upload to the php engine. Even if there is no upload form. Even if there is no php file behind it! as long as the php engine fires up and receives the payload - boom.
My understanding of the #PHPsecurity issue1 is that it exploits uploads -- but if your site doesn't allow public uploads (and you trust all the users who have that ability), I think that means you're safe?
Footnote
1.:
Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619