Two critical PHP flaws trigger global alert; millions of services face cyber risk

 PHP advised users on Oct 23 to temporarily disable its session upload progress feature until the next regular bugfix release. The warning followed an earlier advisory on Oct 21 about a related vulnerability. The latest issue affects applications only when specific session settings are changed while running and the upload progress feature remains enabled. Users who have already disabled the feature do not need to take further action. PHP advised users on Oct 23 to temporarily disable its session upload progress feature until the next regular bugfix release. The warning followed an earlier advisory on Oct 21 about a related vulnerability. The latest issue affects applications only when specific session settings are changed while running and the upload progress feature remains enabled. Users who have already disabled the feature do not need to take further action.