Today's PHP security release, and how we're strengthening security
Learn the exact nginx snippet that mitigates the critical PHP upload‑progress vulnerability and why it matters.
The PHP 8.2.35 security release fixes a heap use‑after‑free in the session.upload_progress extension (CVE‑2026‑109618/‑109619), and a simple nginx rule can block the exploit today. The rule drops any request with a multipart/form‑data content type, which is the only vector the vulnerability uses. Deploying it buys you time while you upgrade PHP.
The vulnerability lives in the upload‑progress heap handling code: when a multipart request arrives, PHP allocates a tracking structure, then frees it prematurely under certain race conditions. An attacker can craft a multipart payload that triggers a use‑after‑free, leading to remote code execution. The nginx mitigation works because it prevents the server from ever seeing a multipart request, so the vulnerable code path never runs.
The three‑line snippet looks like this: if ($http_content_type ~* "multipart/form-data") { return 403; } # optional log line add_header X-Upload-Blocked "true"; It can be placed in the server block or a dedicated location, and it returns a 403 response for any multipart upload. Because the rule is evaluated before PHP processes the request, it adds virtually no overhead and requires no PHP configuration changes.
For developers, the immediate step is to add the snippet to all front‑end nginx proxies serving PHP applications, then schedule an upgrade to PHP 8.2.35 or later. Test your application’s upload flows after the rule; if you rely on legitimate multipart uploads, you’ll need to adjust the rule or move to a temporary alternative such as a separate upload endpoint that bypasses the block.
TakeawayBlocking multipart/form‑data at the web server stops the current PHP upload‑progress UAF until you can upgrade.