HOSTED-POWER/php_uploadprogress_guard
Library
Can I trust it?
Worth a closer look before you use it.
Warnings Check
Very new: it was created yesterday. Wait a little before installing it.
Stars from real accounts No data
We haven't checked its stars for fakes yet.
Active OK
Last change today.
Licence OK
MIT: you can use it for free, also in a commercial product. Keep the licence notice.
Quick checks from public data. They help, but they are no guarantee.
What it is
A small PHP extension that detaches the session upload-progress handler at startup and mirrors the official fix for CVE-2026-109618 and CVE-2026-109619 on unpatched PHP builds, without rebuilding PHP. It steps aside on PHP builds that already include the fix.
Who it's for
System administrators and hosting providers running PHP 5.6 to 8.5 on Debian, cPanel, DirectAdmin or Docker who cannot upgrade PHP immediately
How to use it
Ask your AI to set it up
Paste this into Claude, ChatGPT or your coding assistant.
Help me install and set up HOSTED-POWER/php_uploadprogress_guard in my project. Follow its README: https://github.com/HOSTED-POWER/php_uploadprogress_guard. Explain each step and check it is safe before running anything.
Star curve
Get alerts for repos like this
We'll email you when something in Dev infrastructure starts rising. Free, once a week, only what matches.
18,965 GitHub repos watched and ranked every hour. Figures as of 22 October 2026.
What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy
For maintainers
Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.
[](https://repoalerts.com/repo/HOSTED-POWER/php_uploadprogress_guard?ref=badge)Similar repos
- Zer061/CVE-2026-109618
Proof-of-concept exploit for CVE-2026-109618 and CVE-2026-109619, a heap use-after-free in PHP's session.upload_progress handling. The repository provides exploit.py, which targets a PHP 8.4.26 and Ap
- syrex1013/php2shell
Proof-of-concept exploit and lab for CVE-2026-109618 and CVE-2026-109619, a heap use-after-free in PHP's session.upload_progress handling. Includes a Docker lab reproducing the stale-pointer write on
- junaire/CVE-2026-109618-exploit
Proof-of-concept exploit for CVE-2026-109618 and CVE-2026-109619, an unauthenticated remote code execution flaw in PHP's session.upload_progress handling, with a Docker target environment reproducing
- dinosn/php-cve-2026-10961x-lab-poc
Lab reproduction and vulnerability-research package for PHP 8.5.11 CVE-2026-109618 and CVE-2026-109619, a remote code execution chain using memory disclosure via session cookies and a use-after-free.
- syhunt/php2shell-protection
Test kit and Apache .htaccess rules that reject multipart/form-data POST requests while allowing URL-encoded POSTs, with request-size limits and hardening measures against php2shell (CVE-2026-109618,
- ikow/php2shell-poc
Research toolkit for two PHP pre-auth RCE vulnerabilities (CVE-2026-109618/109619) abusing session.upload_progress. Includes five chain descriptions, three exploit scripts, detection rules for Suricat