Mark Gadala-Maria on X: " BREAKING: IT JUST KEEPS GETTING WORSE FOR PHP. A ...

Mark Gadala-Maria @markgadala 🚨 BREAKING: IT JUST KEEPS GETTING WORSE FOR PHP. A THIRD remote code execution vulnerability has JUST been disclosed, only 48 HOURS after PHP released emergency patches for two critical security flaws. And this one is STILL UNPATCHED. Here's what we know: → NEW RCE DISCOVERED: CVE-2026-115560 could allow attackers to remotely execute malicious code on affected PHP servers. → NO PATCH AVAILABLE: Even servers updated with Wednesday's emergency security fixes aren't patched against this new vulnerability. → SPECIFIC CONFIGURATIONS AT RISK: The flaw requires an unusual combination of PHP session settings and application code. → DEFAULT FEATURE INVOLVED: PHP's session upload progress feature is enabled by default and is part of the vulnerable configuration. → OFFICIAL MITIGATION: PHP recommends setting session.upload_progress.enabled=0 until the release. → THIRD RCE IN 48 HOURS: Two critical flaws were patched Wednesday. Now another has been disclosed before a fix is available. PHP powers nearly 70% of websites with a known server-side language. THREE remote code execution vulnerabilities disclosed in just DAYS. And now another reminder that even applying the latest security patches doesn't guarantee you're protected against every newly discovered flaw. If you run PHP, CHECK YOUR CONFIGURATION NOW. Made with AI 1:29 PM · Oct 23, 2026 · 20.9K Views 18

Mark Gadala-Maria @markgadala 10h Your website could be vulnerable to critical security flaws right now, and you might not even know it. We're offering a FREE security assessment to help identify vulnerabilities before attackers exploit them. Get yours here: lucidsecurity.si

bounce @existencexo 9h it truely is blacktober brother