Posted by tuyuri 14 hours ago
Maybe Hetzner know a company that can help out with extra computer resource...? /s
Useless. My fault for paying peanuts
(Not even joking, if you're going to go hog go whole-hog.)
I would recommend running this binary as a user that has no access to any files, it can just proxy traffic through a port. I will put that in the README.
Honestly, and not to be harsh, but doing absolutely nothing is better than what you've done here.
Not only is this proxy unlikely to actually protect against the issues, but this code almost certainly has its own, equally bad security vulnerabilities. A 30 second check with Opus 5.5 found at least one heap overflow, multiple memory leaks, and a number of bugs that shows that it doesn't even succeed at doing what it claims. I appreciate that you're trying to help, but there are better tools for the approach that you're going for here, and injecting noise with AI slop that isn't even reviewed at a basic level is causing noise, confusion, and potential harm in an already urgent, tense situation.
https://github.com/Qbix/proxy/blob/main/src/sanitize.c#L41 https://github.com/php/php-src/blob/master/main/SAPI.c#L162
The article linked from your own README (https://sansec.io/research/php2shell) has a better partial mitigation in existing, battle-tested reverse proxies. Even still, as that article says, everything here is a partial mitigation. The description of the issues in your project's README is an inaccurate understatement of the severity of the issues. "CVE-2026-109618 — heap use-after-free in the session.upload_progress handler" is an incomplete understatement of the issue, the session.upload_progress handler is only one of a number of potential exploitation paths. https://github.com/php/php-src/security/advisories/GHSA-w8hw... has some hints at other paths, of which there are many.
From an LLM, and quickly validated by me, a heap overflow, likely an RCE.
> src/http.c:101-116 and src/util.c:9
Attacker supplied value in strtoul, the size-limit checks are unsigned addition that can wrap, and you can follow the chain from there.
> or better yet submit a request.
This project is not deserving of fixing, it should just be deleted and direct people to more serious documentation of fixes and mitigations. This code is clearly AI-generated slop, it is not my responsibility to fix your project.
> I could understand if you actually at least clicked and looked at the repository, and read what it’s about. But you chose to simply write generic text without looking at anything. You want to discourage people from protecting their servers, in order to feel good about yourself. What amount of effort have you put into understanding what you’re even talking about?
Every accusation is an admission.
It's free and MIT licensed, open source and it is currently the only alternative to patching your PHP. The "profit" is for people who don't get PWNED today!!!
Many people can't patch your PHP. If you can't be bothered to even look at the repo, you may want to sit this one out.
UPDATE: Just going to ship a Linux binary for now, that's where most hosting is. Almost no one hosts from a MacOS or Windows machine. The Cosmo binary was overkill here.
Nobody should trust this.
GitHub actions builds from source
1. session.upload_progress.enabled = Off, in php.ini and as php_admin_flag in every FPM pool, so per-directory config can't turn it back on. It's one of the two confirmed consumers in GHSA-6wmf, and the validated FPM path depends on it. Almost nobody uses it, and the advisory suggests leaving it off even after patching.
2. Refuse multipart request bodies at the web server, before PHP parses them. All of the GHSA-w8hw out-of-memory strategies go through multipart parsing. On Apache it's a rewrite rule matching a Content-Type of multipart/form-data that returns 403. On Caddy it's a header matcher that responds 403. The cost: every browser upload breaks (media library, plugin zips, importers). Check your public forms first.
3. Check your SAPI. Both bugs have confirmed RCE against mod_php. FPM is narrower: the validated path needs upload_progress, and the early INI consumer only applies if your front end sends PHP_VALUE/PHP_ADMIN_VALUE. To check, grep your Apache, nginx and Caddy configs for it, and run apache2ctl -M | grep php.
4. pm.max_requests = 1 in the pools. A worker serves one request and exits, which breaks the stale-state chain: the "producer" and "consumer" requests must land on the same worker. It costs a fork per request.
5. Lower max_input_nesting_level and post_max_size, per the advisory.
6. Housekeeping that should already be done: no .php served from uploads directories, and remove any stray phpinfo.php. Scanners request it constantly, and it tells an attacker your exact build.
The fact is you had no idea how useful or dangerous your advice was. PHP maintainers said to shut it down, how many people followed your advice instead? Did it work or just leave them vulnerable? Do you know?
Because you're heavily implying that the people who knew about the details of the vulnerability were panicking and thank god we had you with an LLM