PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

Ahead of PHP's scheduled fix for two critical flaws nicknamed PHP2Shell, security researchers are walking back earlier advice that a single configuration change could protect systems. PHP rates the bugs 9.2 out of 10 and plans to release patches at 14:00 UTC on October 21, but has not disclosed affected versions or the vulnerable component, saying details will come with the update.

GMO Flatt Security, which first suggested disabling the session.upload_progress.enabled setting as a stopgap, now says this alone cannot be trusted to block exploitation and expects bypasses to exist. A PHP core developer echoed this, stating only patching actually fixes the issue. No in-the-wild exploitation has been confirmed so far, but organizations are urged to isolate exposed PHP servers, limit what a compromised host can access, and be ready to apply the patch the moment it is released rather than rely on the workaround as a substitute.

Administrators running unsupported PHP branches (anything older than 8.2) get no fix and should consider taking systems offline or restricting network access until they can upgrade.