/dev/null
Sign in

Commit

a06d0db

Brent Roose@brendt
Small PHP security followup, worth checking out
QuotingNANils Adermann@naderman
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 on Wednesday, keep it disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected.…
php.netPHP: News Archive - 2026PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
Lovro Papež@cannonsh
How applicable is this to default installs through Laravel Forge and DO?

commit a06d0db

NW
Nick Woodhead
On Forge it's one line per server: open the server's PHP settings in the runtime tab edit the FPM php.ini, add session.upload_progress.enabled = 0, then restart PHP-FPM.