Wrong day to setup another #wordpress #blog #php https://wordpress.labb.sunet.se/
0 Boosts
0 Likes
@woozle
The PHP engine parses the request that contains uploaded files and hits the bug. This happens long before your application code runs and tries to handle that request. So no, you are not safe.
@woozle how do you disallow public uploads? To my knowledge (which is only from reading blogs), it's enough to send a malicious upload to the php engine. Even if there is no upload form. Even if there is no php file behind it! as long as the php engine fires up and receives the payload - boom.
@Ascendor Yeah, it's a little unclear. The mitigation instructions in the sansec.io link talk about disabling uploads at the httpd level, so maybe PHP simply not accepting files isn't enough.
(I absolutely don't have the time to go through all fifty-leven of my PHP sites and add that code to the vconfig for each of them, so... I'll let you know if I find out I've been hacked! 😅)
@woozle Is shutting down an option for you?
Update: apparently the bug happens before any of the site-code gets executed, which is why you have to deny uploads at the site level.
Unfortunately I absolutely do not have the time to go through all fifty-leven of my PHP sites and add that code to the vconfig for each of them, so... I'll let you know if I find out I've been hacked! 😅
Original post
My understanding of the #PHPsecurity issue1 is that it exploits uploads -- but if your site doesn't allow public uploads (and you trust all the users who have that ability), I think that means you're safe?
Footnote
1.:
Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619