php2shell POC Leaked Early: Mitigation Alone May Not Be Enough, Patch PHP Now
basedjensen · x · 2026-10-21
Security researcher Kostastsale warns that a POC for the php2shell vulnerability was released early and mitigation may not be enough—public-facing servers should patch or be taken offline. For PHP < 8.2: set session.uploadprogress.enabled = Off in php.ini and reload php-fpm; newer versions should update (fix imminent). A PHP core developer confirms patching/upgrading is the only complete fix.
More from Safety
- PHP pre-announces two CVSS 9.2 critical vulns as Cloudflare races to deploy WAF rules — mitsuhiko · 2026-10-21
- Dev builds attest: position-aware prompt-injection scanner for MCP tool descriptions — mrpkk · 2026-10-21
- Least privilege, research/action split: lessons from a sales agent that faced prompt injection — Adept_Direction2591 · 2026-10-21
- User documents several real dangerous Gemini incidents in one thread — Regular_Manager_6235 · 2026-10-21
- Sentry CEO on SOC2 in the AI era: verify who's merging your code — zeeg · 2026-10-21
- 'PHPcolypse': More UAF Bugs Found in PHP Core, Dev Suggests Rewriting with Codex — basedjensen · 2026-10-21