Two cached bucket pointers, one freed tree. A heap use-after-free in PHP session.upload_progress reaching zend_call_function.
PHP's session.upload_progress handler (php_session_rfc1867_callback in ext/session/session.c) caches two raw zval * bucket pointers into live HashTables: post_bytes_processed and current_file_bytes_processed. Both point into arrays that the request lifecycle frees under the attacker's feet. Press [SOURCE] above to walk the full bundle: the trigger request, both PoC chains, the extraction harness, and the validated per-build symbol deltas.
Stock configuration is enough. session.upload_progress.enabled=1 and the default name, prefix, freq=1%, min_freq=1. A single fast multipart POST arms both caches; a second update() re-reads the session file and zend_hash_update destroys the previous decoded tree through its HashTable destructor zval_ptr_dtor. The freed bucket is then reclaimed and the stale pointer lands an attacker-shaped zend_fcall_info / zend_internal_function that calls zend_call_function, i.e. system().
