A New PHP Risk Needs a Workaround, Plus 2 Stories
The PHP session upload progress vulnerability disclosed Friday changes the cleanup work from this week’s critical patches. The new flaw is narrower and PHP calls remote code execution unlikely, but it affects a configuration that no released PHP update fixes yet. If you run a PHP website, including WordPress, the sensible move is a configuration check rather than panic.
PHP has another flaw, and this one needs a temporary setting change
On October 23, the PHP project disclosed CVE-2026-115560, a third session-related flaw following the two critical vulnerabilities patched on October 21. This is a materially different problem from the bugs covered in Thursday’s Daily Brief: there is no fixed PHP version for it yet. PHP plans to ship the repair in its next regular bug-fix release.
The affected setup is unusual. A server must configure PHP’s session serializer as php_binary or php_serialize, then application code must switch it to php with ini_set() before starting the session. The session upload-progress feature also has to remain enabled. That feature lets an application report how much of a file upload has arrived. The flaw is in the handoff between those session formats and that early upload tracking, not in file uploads generally.
That narrow recipe matters because it tells us who should worry. PHP says applications that never change the serializer at runtime can leave upload progress enabled. If you know your configuration and code, check those conditions. If you don’t know, or you manage a mixed fleet of applications, the temporary conservative setting is session.upload_progress.enabled=0.
Put that setting in php.ini, an FPM pool, or server configuration that applies before request parsing, then restart every PHP worker. Changing it inside application code is too late. CERT-EU specifically warns not to rely on ini_set() or an FPM .user.ini file for this mitigation.
If you already disabled upload progress for CVE-2026-109619 earlier this week, keep the setting and there is nothing new to do. And do not confuse this workaround with the October 21 patches. Servers still need PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor backport for the earlier critical bugs. One switch does not magically turn three vulnerabilities into a pleasant memory.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
AWS capacity is being reserved years ahead
Amazon CEO Andy Jassy says AWS’s cloud capacity is largely sold out through 2027, with significant commitments reaching into 2028. Reuters reports that AI laboratories and large enterprises are locking in power, chips, and data-center space well before the machines arrive. Amazon still reserves some capacity for on-demand EC2 and Bedrock customers, so this is not a warning that an ordinary website will suddenly lose its server.
What it does show is how different AI infrastructure has become from the cloud story businesses were sold for years. The familiar pitch was elastic capacity: request more computing, pay for it, release it when you are done. Large AI workloads need scarce accelerators, enormous electrical connections, and facilities that take years to permit and build. At that scale, “the cloud” starts looking less like a utility tap and more like a factory you reserve before construction.
Small businesses do not need to buy servers through 2028. They should, however, be skeptical of plans that assume AI inference and training will always become cheaper on schedule. If a project depends on one model, one provider, and a large block of GPU time, capacity risk belongs in the budget beside software and staffing. Keep workload portability in the design, test smaller models where they are good enough, and make sure the business still works if compute costs fall more slowly than the sales presentation promised.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
PwC’s training vendor shows why “secondary” systems still matter
PwC confirmed a cybersecurity incident at a third-party vendor that hosted employee learning records. The firm says the affected site contained no client data, sensitive personal data, or financial information, and that PwC’s own network and operations were not affected.
An extortion group called Everest claims it stole about 590 gigabytes, including learning-platform exports, employment history, and integration documents. Reuters could not independently verify the amount or the group’s description, and PwC did not confirm those claims. That distinction matters. A confirmed vendor incident is not proof that every file in an attacker’s advertisement exists.
Still, the practical lesson survives the uncertainty. Training systems, applicant portals, benefits sites, and scheduling tools can accumulate names, email addresses, job history, organizational relationships, and technical notes about how they connect to other systems. They may not hold payroll or customer records, but attackers do not grade stolen data on the same neat risk chart used during procurement.
There is no general password-reset instruction here. PwC employees should follow verified notices from the firm and the vendor. For other organizations, this is a good prompt to ask three plain questions: which vendors can export staff records, how long do they keep those exports, and who has to tell you when something goes wrong? “It’s only the training platform” is not a control.
Today’s three stories are really about hidden constraints. A PHP feature can run before the application gets a chance to defend itself. Cloud capacity can be spoken for before a project starts. A peripheral vendor can retain a useful map of employees and systems. The practical response is not fear. It is knowing where the important decisions are actually made, and whether you still control them.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- PHP project: 2026 news archive and October 23 advisory
- CERT-EU: Critical Vulnerabilities in PHP
- Cloudflare: PHP vulnerability protections and limitations
- Reuters: Amazon cloud capacity sold out through 2027
- Reuters: PwC confirms incident involving employee learning records
Photo by Daniil Komov on Pexels.
