PHP2Shell Fixes Drop at 14:00 UTC; Workaround Deemed Insufficient by Experts
Critical PHP flaws get patches today. Experts warn that popular configuration tweaks do not offer full protection before the update is applied.
Key points
- PHP releases fixes for two 9.2-rated flaws at 14:00 UTC on October 21.
- GMO Flatt Security retracted advice that disabling session upload progress was sufficient.
- No confirmed attacks have been reported, and affected versions are not yet public.
PHP will release patches for two critical remote code execution flaws, collectively known as PHP2Shell, at 14:00 UTC on October 21. The project rates both vulnerabilities at 9.2 out of 10 in severity. Until the update is installed, administrators cannot fully block exploitation, according to The Hacker News.
Security researchers emphasize that no temporary configuration change offers complete protection before the patch. GMO Flatt Security, which initially suggested a specific setting change, later stated that attacks bypassing that measure are expected. PHP provides no official workaround of its own.
Context on the Proposed Workaround
The setting circulating on social media and security blogs is `session.upload_progress.enabled=0`. This disables Session Upload Progress, a feature enabled by default that tracks file upload status. GMO Flatt Security suggested this change early on October 21, noting it might help with some probability.
Later that day, the Tokyo-based firm walked back that advice. In an update timestamped 14:00 Japan time, they stated the setting alone is not a complete fix. They advised administrators to prepare the update and watch for attack traffic rather than relying on the configuration change.
Impact and Affected Systems
No attacks have been reported as of the publication time. PHP has not specified which versions are affected, which component is involved, or whether any settings change the risk. The project states that full details and fixed versions will accompany the release.
Gina Peter Banyard, a PHP core developer and documentation writer funded by the PHP Foundation, reinforced the need for patching. She stated that the only mitigation is upgrading PHP, adding that she knows too much to suggest otherwise.
What should you do?
Administrators should prepare their systems to apply the update the moment it lands. Until then, risk reduction involves taking exposed PHP off the internet or placing it behind strict access controls. Limiting what a compromised server can reach also lowers potential damage.
What to do and how to stay safe: PHP
- Isolate exposed PHP servers from the public internet or restrict access via firewalls until the patch is applied.
- Prepare automated update scripts or manual procedures to install the PHP fix immediately upon release at 14:00 UTC.
- Monitor server logs for unusual traffic patterns that may indicate attempted exploitation before the patch is deployed.
- Limit the permissions of the PHP process to restrict lateral movement if a server is compromised.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the session.upload_progress.enabled=0 setting a sufficient fix for PHP2Shell?
No, GMO Flatt Security stated that this setting alone is not a complete fix and that attacks bypassing it are expected.
When will the PHP patches for PHP2Shell be available?
PHP will release the fixes at 14:00 UTC on October 21.
Are there any confirmed attacks exploiting these vulnerabilities?
No attacks have been reported as of the time of writing.
