PHP rates two PHP2Shell flaws 9.2; fix due October 21
Original title: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
No attacks are reported, PHP offered no workaround, and disabling upload progress is not a full fix.
PHP plans to release fixes at 14:00 UTC on October 21 for two flaws it scores 9.2 out of 10, without naming affected versions or the component. GMO Flatt Security later said setting session.upload_progress.enabled=0 is not complete and that bypasses are expected. PHP core developer Gina Peter Banyard said only patching or upgrading works. CERT-EU advises isolating internet-facing applications until a fix is applied. PHP issues fixes only for supported branches 8.2 through 8.5.
Unconfirmed: PHP has not confirmed the bugs are in Session Upload Progress, and an anonymous audit disputes that specific bug.
- At writing, the release was not yet out and fixed versions were unannounced.
- watchTowr says there is no confirmed patch or workaround.
- Upwind still lists the upload-progress setting as an immediate mitigation.
- Branches older than 8.2, including 8.1, 7.x, and 5.x, receive no PHP fixes.
- Cloudflare added emergency anomalous-execution rules on October 21.
Impact: remote code execution from two PHP flaws rated 9.2
| Product | Affected |
|---|---|
| PHP | — |
- 1.Apply the PHP web-runtime update as soon as it lands at 14:00 UTC.
- 2.Isolate internet-facing PHP or restrict it with VPN, allowlists, or authentication.
- 3.Do not treat session.upload_progress.enabled=0 as complete protection.
- Products
- PHP
From the original article
6 min read at thehackernews.com
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9. 2 out of 10, and has given no workaround of its own.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.