PHP2Shell: No Complete Workaround Exists Before Today's Critical PHP Patch

PHP will release a fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10. PHP has offered no workaround of its own. It has not said which versions are affected, which part of PHP is involved, or whether any setting changes the risk. Those details are due with the release. No attacks have been reported.

A one-line setting has been circulating on social media and security blogs: session.upload_progress.enabled=0. It turns off Session Upload Progress, a feature that is enabled by default and tracks how far a file upload has progressed. GMO Flatt Security, a Tokyo firm, first suggested it, but said it could not be sure the change fully addresses the flaws. Later that day the firm walked this back, saying the setting alone is not a complete fix and that attacks getting around it are expected.

Gina Peter Banyard, a PHP core developer funded by the PHP Foundation, was blunter: the only mitigation is patching or upgrading PHP. Because the release was not yet out at the time of writing, nobody outside the group that found the flaws can test whether a defence works. Until the update lands, risk can be lowered by taking exposed PHP off the internet or behind access controls, limiting what a compromised server can reach, and having the update ready to apply immediately.