session.upload_progress

Assess

Techniques

PHP session upload progress feature that tracks multipart upload progress during request handling.

Why it's here

Placed in Assess: 1 article(s) of evidence from 1 source(s), led by security coverage, with 1 in the last 30 days. Confidence 24%. Low accumulated evidence, so it defaults conservatively pending more signal.

Evidence (1)

8Hacker News·10/21/2026security
PHP session.upload_progress cross-request UAF vulnerability
A Hacker News post reports corrected findings for two PHP issues in the session.upload_progress path. The earlier cached-pointer chain is described as non-exploitable, while the real issue is a cross-request use-after-free in PHP's serialization state that was ASAN-confirmed and rated medium severity, affecting prefork-style deployments.