Research
Advisories, exploitation chains and analysis. Each one comes with a proof of concept.
2026
One upload request crashes any Express app that uses multer with an async fileFilter
The request gets a normal 400 back. The process dies a few hundred milliseconds later.
From a cross-request use-after-free in PHP's upload progress to code execution
An independent reproduction of the bug, its root cause, and a full exploitation chain on PHP 8.5.11.