HOSTED-POWER / php_uploadprogress_guard

# hp_uploadprogress_guard
**v3.2.4, 23 October 2026: two protections PHP itself does not ship yet.** Since the php2shell releases, two
more problems have surfaced in current PHP. This module now covers both, on patched and unpatched PHP alike,
so **keep it installed after you upgrade.**
* **`unserialize()` use-after-free, in every current release.** When `unserialize()` cleans up, it frees its
 bookkeeping first and then runs object destructors; a destructor that calls `unserialize()` again works on
 freed memory. This is the bug behind the "PHP 8.5.12 patch is incomplete" claims. Present in 8.5.12,
 8.4.27, 8.3.36, 8.2.35 and older; reachable when an application unserializes attacker-controlled data, or
 by code already running on the host. Not fixed in any PHP release, no CVE (PHP does not assign CVEs to
 `unserialize()` bugs): php-src#24481.
 **Closed by the module since v3.2.0**: such nested calls get their own state. Verified with Valgrind on all
 five releases named here: freed-memory reads without the module, none with it.
* **SimpleXML crashes, introduced by 8.4.27 and 8.5.12.** The security release changed the garbage collector,
 and SimpleXML now frees its property table twice when an object converted with `json_encode()`, `(array)`
 or `get_object_vars()` (the everyday `json_decode(json_encode($xml), true)`) is collected in a reference
 cycle: `zend_mm_heap corrupted`, a crashed worker. Fix approved by PHP, not released yet:
 php-src#24488.
 **Fixed by the module since v3.2.1**, by applying PHP's approved fix from inside the module, only on those
 two releases. On a staging host with 8.4.27, a plain SimpleXML script crashed before and completed after.
Nothing changes for applications: identical output with and without the module on every branch from 5.4 to
8.5, and PHP's own serialize, session and SimpleXML test suites give the same results. Details and tests
further down.
**What it is.** A small PHP extension that mirrors the official fix for
CVE-2026-109618 / CVE-2026-109619 component by component, so that on an unpatched PHP every link of
the published attack chain is removed, without rebuilding PHP and without changing anything for the
applications on the host. Built by Hosted Power for its own fleet,
published for everyone. PHP 5.4 through 8.5; Sury, Remi, cPanel EA4, DirectAdmin CustomBuild, official
Docker images. **Prebuilt for Linux x86_64 and arm64 (aarch64), every branch from 5.4 to 8.5, and for
Windows x64** (7.2 to 8.5, nts and ts), with checksums; one C source file for everything else. On a PHP that already carries the php2shell fix,
vendor backports included, its php2shell layers notice that and step aside; the two protections above stay on,
and so does the detached session upload-progress handler (see point 4 below).
**Install the official PHP release** (8.5.12, 8.4.27, 8.3.36, 8.2.35, and the PHP team's backports
for 7.4, 8.0 and 8.1, which Sury extended down to 5.6); we recommend it without reservation. **This
module