php2shell

CVE-2026-109618 · CVE-2026-109619 · live notes

Unpatched. PHP fix due 14:00 UTC today. Mitigate now.

PHP release: 14:00 UTC

Auto-refreshes every 10s. Last updated 12:55 UTC.

php2shell, short version

Live updates

  1. Dozens of “php2shell PoC” repos on GitHub since midnight. Validity unknown. Don't run them on anything you care about.

  2. Precautionary takedowns in NL: Tweakers, Tweede Kamer, NCSC, Security.NL all offline. Sansec

  3. On Remi's repo (RHEL/Fedora)? No update today, per the PHP Foundation. Switch to distro packages or build from source now.

  4. Cloudflare reports early attacks and has pushed WAF rules to every plan, free included. Only helps if your origin rejects non-Cloudflare IPs.

  5. GMO Flatt Security: exploit code claiming to work is circulating. Disabling session.upload_progress mitigates but does not stop it. Flatt (JA)

  6. PHP core dev Gina Peter Banyard: patching is the only mitigation. If you can afford it, take PHP offline for the day.

  7. PHP security team: two criticals, CVSS v4 9.2, release Wed 14:00 UTC, earlier if details leak or exploitation appears. php.net

  8. HN post says two PHP RCEs drop Thursday. Pulled fast; screenshots spread. watchTowr confirms the leak is real.

Mitigate now

Stopgaps until you can patch. None of these is a fix. Remove them after you update PHP.

1. Block multipart at the web server

PHP parses multipart bodies before your code runs, so app-level fixes and maintenance modes don't help. Reject them in front of PHP.

nginx: every server block that passes to PHP, then nginx -t && systemctl reload nginx

if ($http_content_type ~* "multipart/form-data") {
    return 403;
}

Apache: every <VirtualHost> serving PHP, then reload

RewriteEngine On
RewriteCond %{HTTP:Content-Type} multipart/form-data [NC]
RewriteRule ^ - [F]

Breaks every file upload, plus any form sent as multipart (some carts and checkouts). Place a test order. Allowlist only upload routes you can't live without.

2. Or go read-only, or offline

Can you go a day without PHP? Stop php-fpm and serve a static page. That's the safest move. Otherwise allow only GET and HEAD:

if ($request_method !~ ^(GET|HEAD)$) {
    return 503;
}

3. Put it behind Cloudflare

Cloudflare's managed WAF rules cover the known exploits on every plan. They do nothing if attackers can reach your origin directly. Firewall HTTP/HTTPS to Cloudflare's IP ranges.

4. Harden PHP settings

These reduce exposure but do not prevent the attack. Use them in addition to the steps above, never instead of them.

session.upload_progress.enabled = 0
session.use_strict_mode = 1

php-fpm ignores the CLI php.ini. Set it per pool, then reload php8.x-fpm:

; e.g. /etc/php/8.3/fpm/pool.d/www.conf, every pool
php_admin_flag[session.upload_progress.enabled] = off
php_admin_flag[session.use_strict_mode] = on

5. Verify from outside

# expect 403 (or 503 if read-only)
curl -s -o /dev/null -w '%{http_code}\n' -F probe=1 https://example.com/

# expect 200 still
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/

Check the web SAPI, not php -i. Drop this in, load it, delete it:

<?php echo ini_get('session.upload_progress.enabled') ? 'ON' : 'off';

6. Get ready to patch

Watch for compromise

Send in your updates

Seen a release, an exploit in the wild, or a mitigation that works (or breaks)? Tell us. Links help. We post what we can confirm.

Sources