PHP2Shell: Interim Workarounds Cannot Replace the Pending PHP Fix
Summary
PHP’s fix for two critical PHP2Shell flaws was still pending. The article says the circulating session setting is not a reliable safeguard and recommends preparing to patch, restricting exposure, and limiting server access and privileges.
Key points
- PHP had scheduled a fix for two flaws rated 9.2 out of 10 for October 21 at 14:00 UTC; affected versions and fixed builds were not yet announced.
- GMO Flatt Security later cautioned that setting session.upload_progress.enabled=0 alone is not a complete fix; PHP project representatives said patching or upgrading is the only mitigation.
- Cloudflare reported early exploitation attempts and deployed emergency WAF rules as a stopgap. The article says no compromise was confirmed, circulating exploit code had not been shown to work, and the flaws were not listed in CISA’s known-exploited catalog at the time.
- Until a fix is available, recommended steps include removing exposed PHP from the internet or restricting access, limiting server privileges and stored credentials, and preserving secure logs.
- Blocking multipart/form-data requests before they reach PHP may reduce exposure, but can break uploads and forms and is based on a suspected entry path, not a confirmed one.
- PHP fixes are issued for supported branches 8.2–8.5; older branches are end-of-life. After the release, administrators should patch the PHP runtime and check distribution advisories because backported fixes may not change version strings.
Article Details
- Vulnerability Types
- Remote code execution (RCE)
- Severity
- 9.2/10 (rated by PHP)
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Isolate internet-facing applications from public networks until a fix is available, or place them behind a VPN, client allowlist, or authenticated access controls.
- Block multipart/form-data requests at the web server before they reach PHP; this may disrupt file uploads and some forms, and the article describes the suspected entry path as unconfirmed.