HOSTED-POWER/php_uploadprogress_guard

选用指南

AI 根据 README 整理 · 2026/10/22 14:46:35

适用场景

适用于运行未打补丁PHP的服务器，特别是托管环境，在官方补丁发布前或无法立即升级时提供保护。

查看 README 依据

# hp_uploadprogress_guard **v3.1.0, 21 October 2026.** A small PHP extension that mirrors the official fix for CVE-2026-109618 / CVE-2026-109619 component by component, so that on an unpatched PHP every link of the published attack chain is removed, without rebuilding PHP and without changing anything for the applications on the host. Built by [Hosted Power](https://www.hosted-power.com) for its own fleet, published for everyone. PHP 5.6 through 8.5; Sury, Remi, cPanel EA4, DirectAdmin CustomBuild, official

Docker images. On a PHP that already carries the fix, vendor backports included, it notices and steps aside. **Install the official PHP release** (8.5.12, 8.4.27, 8.3.36, 8.2.35, and the PHP team's backports for 7.4, 8.0 and 8.1, which Sury extended down to 5.6); we recommend it without reservation. **This module protects an unpatched PHP for real.** It mirrors the official fix component by component, tested per branch and per SAPI (see the tests below), so a host that runs it is protected today,

使用方式

通过PHP扩展方式加载，配置简单，只需在php.ini中添加extension=hp_uploadprogress_guard.so。

查看 README 依据

you want the belt-and-braces of `force_unlimited_memory`. Two implementation notes. The stop flag is one static per process, which is exact for NTS builds (all prebuilt files); a ZTS build from source could, in theory, see a spurious 413 on a concurrent thread. And php-fpm reads at most `CONTENT_LENGTH` bytes of body on its own, so the no-Content-Length strategy never reaches the parser through FPM; that one is mod_php's (Apache hands the parser a chunked body whole), and it is the strategy the advisory's confirmed exploit used. ### Install ```ini extension=hp_uploadprogress_guard.so ```

部署要求

支持PHP 5.6至8.5版本，提供预编译的NTS x86_64二进制文件，也可从源码构建。

查看 README 依据

# hp_uploadprogress_guard **v3.1.0, 21 October 2026.** A small PHP extension that mirrors the official fix for CVE-2026-109618 / CVE-2026-109619 component by component, so that on an unpatched PHP every link of the published attack chain is removed, without rebuilding PHP and without changing anything for the applications on the host. Built by [Hosted Power](https://www.hosted-power.com) for its own fleet, published for everyone. PHP 5.6 through 8.5; Sury, Remi, cPanel EA4, DirectAdmin CustomBuild, official

That is the whole configuration; the defaults are everything described above, and `force_unlimited_memory` is the only opt-in. Prebuilt NTS x86_64 binaries per PHP minor are in `dist/` with `SHA256SUMS`; `build.sh` rebuilds them from the official Docker images; `src/` has the one C file and the per-branch parser copies. Verify with `php --ri hp_uploadprogress_guard`: it reports whether the handler is detached, whether the carried parser is active, and whether the running PHP already carries the official fix. ### Optional: emergency switch

已知限制

该模块不能替代官方补丁，仅作为临时防护；在已修复的PHP上会自动停用。

查看 README 依据

the entry at `PHP_INI_SYSTEM`: `ini_get()` returns `"0"`, `phpinfo()` shows `Off => Off`, and `.user.ini`, `.htaccess` or `ini_set()` cannot turn it back on. That makes scanners and customers see what the detach already enforces. ### Why you still install the official packages The one thing the module does not do is replace the engine. The patched release changes the memory allocator and OPcache from the inside; a module can mirror what those changes achieve, and since v3.1.0 it does so for every path the

advisories and the fix describe, but it remains a layer around the engine rather than the engine itself. We recommend the official packages, and the module says so itself when it finds them. Until they are installed, and on installs where they never will be, this is protection you can rely on rather than a stopgap; afterwards it costs nothing to leave in place. On `memory_limit=-1` the headroom guard has nothing to guard and is inert; with the module loaded a finite `memory_limit` is fine, so you do not need the advisories' `memory_limit=-1` workaround unless