Yup, I'm seeing several legit people on X claiming to have seen or found the exploit. Some say that: turning session.upload_progress.enabled off and setting file_uploads = Off will mitigate. But others are claiming that those steps are not enough and "Upload progress can serialize before basic RINT clears BG(serialize)". So, I'm taking no chances and taking my services offline.

https://x.com/MagicalTux/status/2112725774025572431 https://x.com/rina4_tot/status/2112723421641531772

I think this exploit + agentic AI (which allows for rapid secret exfiltration/utilization) may be a potent enough combo to trigger a sort of Kessler Syndrome for network security.

▲

defgeneric 6 hours ago | parent | next [-]

If the problem is in the parser then `file_uploads = Off` doesn't help, PHP still parses the multipart body. That seems to be why they're talking about blocking multipart/form-data on routes that don't take uploads and rate-limiting those that do.

▲

int32_64 7 hours ago | parent | prev | next [-]

Mark Karpelès? Wow that's a name I haven't thought about since 2014.

	▲	TacticalCoder 2 hours ago \| parent [-]
		To be honest that clueless individual and its pathetically lame security practices made him lose 800 000 Bitcoin belonging to its customers with Mt Gox, which was written in... PHP. And he went to prison for a few years for it. So he knows something about PHP exploits.

▲

matkoniecz 3 hours ago | parent | prev [-]

> sort of Kessler Syndrome for network security.

why it would be a thing, beyond "serious problem"?