Leftover PHP on a ColdFusion IIS server broke sign-in during mitigation
Original title: Is PHP Running on Your ColdFusion Server? How to Check, and Remove It
A host-wide IIS rule blocked every multipart form, not just .php requests, until the author narrowed it.
Gregory Alexander says a Windows server running ColdFusion on IIS still had PHP left by an old phpMyAdmin install. After PHP shipped emergency patches on October 21 for flaws nicknamed PHP2Shell, his host blocked every multipart/form-data request server-wide, which stopped ColdFusion admin sign-in and uploads. He later limited the rule to .php addresses, found the phpMyAdmin login exposed to the internet, and removed unused PHP.
Unconfirmed: The post does not name CVE identifiers or say the PHP flaws are being exploited.
- The stated PHP fixes are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- PHP's own advice is to patch, not to block multipart requests.
- Temporary mitigations named are disabling session.uploadprogress.enabled and lowering postmaxsize.
- He advises backing up the IIS configuration before removing the handler and FastCGI entry.
Impact: Unauthenticated code execution on web-serving PHP, as described by the author
| Product | Affected | Fixed in |
|---|---|---|
| PHP | web-serving PHP before the emergency patches | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
- 1.Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 rather than blocking all multipart requests.
- 2.Check IIS handler mappings and site folders for unused PHP and phpMyAdmin.
- 3.Scope any temporary rewrite rule to .php addresses if PHP must remain.
From the original article
4 min read at gregoryalexander.com• [](javascript:toggleSideBarPanel(2)) Menu Top Gregory's Blog Gregory Alexander Web Design Galaxie Blog Documentation [Contact](javascript:createAddCommentSubscribeWindow('', 'contact', false);) Bottom Categories CSS Food HQL Tech Travel Wildlife About [About this Blog](javascript:createAboutWindow(1);) [Biography](javascript:createAboutWindow(2);) [Download](javascript:createAboutWindow(3);) [](https://www.
By rmason · gregoryalexander.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.