Weaponized PHP Zero-Day Exploit Leaks Before Official Patch

A weaponized heap use-after-free exploit targeting PHP's session.upload_progress handler has been published, exposing servers to remote code execution. The vulnerability impacts stock configurations across recent stable PHP versions, including 8.5.11, 8.4.26, 8.3.35, and 8.2.34, with the trigger requiring only a single fast multipart POST request. Researchers isolated the root cause to two cached bucket pointers—post_bytes_processed and current_file_bytes_processed—that are freed during the request lifecycle, allowing attackers to hijack execution flow to zend_call_function. The leaked framework includes per-build delta extraction tools to calculate memory offsets for specific distributions like Debian bookworm, noble, and jammy. Until official patches are distributed, administrators are advised to set session.upload_progress.enabled = Off in their php.ini files to close the primary attack vector.