
Disabling PHP Upload Progress: What It Covers
One PHP setting blocks the confirmed session paths of CVE-2026-109619 and mitigates CVE-2026-115560, but it does nothing for CVE-2026-109618. Here is where to set it and what it breaks.
Ashir is a staff writer at GetCoreTech, covering Cybersecurity and Developer & Programming. He works where the two meet: secure development, software supply chain security and the day-to-day decisions developers and security teams have to make.
His recent topics include software bills of materials (SBOMs), passkeys versus passwords, multi-factor authentication, keeping API keys out of code, and what a small team should do in the first 24 hours of a ransomware attack. He also covers how to choose between REST, GraphQL and gRPC.
His writing takes a defensive approach. Each article states who is affected and how you would notice the problem. It ends with a prioritized list of what to do today, this week, and later. Claims are tied to primary sources such as CISA, NIST and official documentation.