PHP Session Upload Progress Advisory: CVE-2026-115560 Mitigation and Scope

·6 views

PHP published an informational notice on October 23, 2026, about CVE-2026-115560, which applies only when the session serialize handler is set to php_binary or php_serialize and then changed at runtime to php before session_start() with session upload progress enabled. PHP describes remote code execution through this path as unlikely and recommends disabling upload progress until the next regular bugfix release, while noting that applications that never change the handler at runtime can keep it enabled. A full advisory is promised, but no complete list of affected versions or CVSS score has been published yet, and cPanel has said affected versions remain unknown. Red Hat states the recommended mitigation is fully protective and gives guidance for enforcing it in FPM and Apache. A ZoomEye search for app="PHP" returned about 111 million PHP fingerprint matches, which reflects general PHP deployment rather than confirmed vulnerable systems.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Study finds many Lovable-built apps expose Supabase data on first page load

Researchers at Crissy Field examined 159,041 Lovable projects, of which 34,545 used Supabase. Of 24,664 sites examined more closely, many were already serving database records to visitors without any login. Further read-only requests with the public key surfaced email addresses in thousands of sites, along with more sensitive items such as passport details and chat messages. The authors caution that data appearing on first load is not automatically a confirmed leak, and the roughly 30% figure applies only to the sampled sites, not all Lovable apps. Security advisers stress that anon keys are meant to be public, so the real risk lies in missing or permissive row-level security rules.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why 'Where Is My Parcel?' Can Signal Different Buyer Needs

The phrase 'where is my parcel' is a common after-sale message that can carry very different meanings depending on context. Buyers may be impatient while still inside the delivery window, anxious after it has closed and tracking has stalled, or weighing a return or dispute. Replying only to the literal tracking question fits none of these situations well. Support teams are advised to check order age against the promised window, message history, carrier status, and wording before responding. The reply should then match the situation: a date for nudges, a concrete plan for anxious buyers, and a clear decision point for those considering returns.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Summer Engine, Ziva and Flockbay compared as Godot AI tools for 2026

A developer who builds Flockbay, one of three Godot AI tools, compares it against Ziva and Summer Engine as of October 2026. Ziva is a proprietary plugin for Godot 4.2 and later that works inside the existing editor, with hosted models from $20 a month. Summer Engine is a separate proprietary engine built on a Godot 4.7.2 base, offering hosted AI at $20, $60 or $200 monthly. Flockbay supports Godot 4.6 and later, bundles the official engine, and offers free AI. The two rivals disagree on whether Ziva can actually run and playtest a game, and the article notes that each product's comparison page was written by its own maker.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python PII Scanner Validates Matches to Cut False Positives in Data Discovery

Knowing where personal data sits is a prerequisite for encrypting, masking, or deleting it, and regulations such as GDPR Article 30 require a record of the categories processed. A plain regex scan tends to flag harmless values like order numbers, timestamps, and SKUs, which makes its reports hard to use. The article presents a Python scanner that samples each column with reservoir sampling, uses regexes to find candidates, and then validates them with checksums and format rules such as Luhn, mod-97 for IBANs, and SSA rules for SSNs. It combines validation results with the column name to assign a per-column confidence score and writes an inventory in JSON and Markdown. The author tests the approach on a synthetic SQLite database and CSV files, and compares the results with Microsoft Presidio.

0 comments Read more at DEV Community