Why Are You Here?... personal blog
PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)
FINAL STATUS (2026-10-21): the CVE-2026-109618 / CVE-2026-109619 memory-corruption class shipped patches 2026-10-21. On the patch, that class is closed: the cached-pointer chain dies at the addref and the serialize-state path is a memory-safety bug, not code execution. Two session-handling flaws survive on…
- Points
- 187
- HN comments
- 62
- Submissions
- 1
- Cited by
- 7 commenters
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Oct 21, 2026 | PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) by rfarley04 | 187 | 62 |
Cited in comments
Linked from 8 Hacker News comments by 7 different people, from Oct 2026 to Oct 2026.
Most recent:
- benibela · Oct 21, 2026
- mirashii · Oct 21, 2026
- richardbarosky · Oct 21, 2026
- Mooty · Oct 21, 2026
- Mooty · Oct 21, 2026
- sdfgsdfgsdsdfgs · Oct 21, 2026
