RemiPelloux/php-session-upload-progress-uaf
Independent source-level analysis and detection tooling for the PHP session.upload_progress pre-RINIT use-after-free (CVE-2026-109618 / CVE-2026-109619, CVSS 9.2, fixed 2026-10-21). Includes a heap layout study, a reproduction lab, an exposure scanner and a one-line remediation guide.
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.