PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given no workaround of its own.
Until you can install it, what lowers your risk is taking exposed PHP off the internet or behind access controls, cutting what a compromised server can reach, and having the update ready to apply the moment it lands.
No compromise has been confirmed, the public exploit code going around has not been shown to work, and neither flaw is in CISA's catalog of known exploited flaws.
So nobody outside the group that found the flaws can test whether a given defense works, which is why the advice below is about lowering risk, not promising safety.
Replying to someone who suggested the upload-progress setting might patch the flaw, Gina Peter Banyard, a PHP core developer and documentation writer funded by the PHP Foundation, wrote : "The only thing I can say is that the only mitigation is patching / upgrading PHP.
Cloudflare says it is seeing early attempts to exploit the flaws, and has pushed emergency rules for sites behind it that it calls a stopgap until you patch.
PHP has not said which versions are affected, which part of PHP is involved, or whether any setting changes the risk; it says the full details and the fixed versions come with the release.
It turns off Session Upload Progress, a PHP feature that's enabled by default, which records how far a file upload has progressed so another request can check on it.
GMO Flatt Security, a Tokyo security firm, suggested setting it early on October 21, saying it could not be sure the change fully addresses the flaws but thought it would help with some probability.
The workaround spreading on social media and security blogs is one line in a PHP configuration file: session.upload_progress.enabled=0 .
PHP's own manual already advises turning the feature off where an application does not use upload progress bars, because the stored file names and field names If you turned it on by mistake somewhere that needs it, the only cost is that upload progress bars stop working.
Check that the change is actually in effect on the process that serves web traffic, not on the command line.
In an update timestamped 14:00 Japan time (05:00 UTC), it said the setting alone is not a complete fix and that attacks getting around it are expected.
What happened
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given no workaround of its own.
Until you can install it, what lowers your risk is taking exposed PHP off the internet or behind access controls, cutting what a compromised server can reach, and having the update ready to apply the moment it lands.
What changed
No compromise has been confirmed, the public exploit code going around has not been shown to work, and neither flaw is in CISA's catalog of known exploited flaws.
So nobody outside the group that found the flaws can test whether a given defense works, which is why the advice below is about lowering risk, not promising safety.
Replying to someone who suggested the upload-progress setting might patch the flaw, Gina Peter Banyard, a PHP core developer and documentation writer funded by the PHP Foundation, wrote : "The only thing I can say is that the only mitigation is patching / upgrading PHP.
Who is affected
Cloudflare says it is seeing early attempts to exploit the flaws, and has pushed emergency rules for sites behind it that it calls a stopgap until you patch.
PHP has not said which versions are affected, which part of PHP is involved, or whether any setting changes the risk; it says the full details and the fixed versions come with the release.
Why it matters
It turns off Session Upload Progress, a PHP feature that's enabled by default, which records how far a file upload has progressed so another request can check on it.
GMO Flatt Security, a Tokyo security firm, suggested setting it early on October 21, saying it could not be sure the change fully addresses the flaws but thought it would help with some probability.
Technical details
The workaround spreading on social media and security blogs is one line in a PHP configuration file: session.upload_progress.enabled=0 .
PHP's own manual already advises turning the feature off where an application does not use upload progress bars, because the stored file names and field names If you turned it on by mistake somewhere that needs it, the only cost is that upload progress bars stop working.
Check that the change is actually in effect on the process that serves web traffic, not on the command line.
Response
In an update timestamped 14:00 Japan time (05:00 UTC), it said the setting alone is not a complete fix and that attacks getting around it are expected.
It told administrators to prepare their update, watch for attack traffic before the release, and apply the fix as soon as it is out.
What security teams should do
One vendor, Upwind, still lists the setting as an immediate mitigation , passing along another researcher's analysis rather than its own tests.
A .user.ini file is read only by the CGI and FastCGI versions of PHP, not by the Apache module, and PHP re-reads it only every 300 seconds by default, so a change there can take five minutes to apply.
What remains unknown
PHP has not said which versions are affected, which part of PHP is involved, or whether any setting changes the risk; it says the full details and the fixed versions come with the release.
GMO Flatt expects a way around it but has not said what that is.
Attribution
The Hacker News: You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
Help Net Security: OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware.
BleepingComputer: Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts.
BleepingComputer: French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.