php2shell/checker
php2shell/checker

Tool & guidance

The project

Public headers. Clear evidence. A practical next step.

Configuration guide

PHP2Shell workaround: partial mitigation only

Generate configuration to disable session upload progress, understand its limits, and plan the complete fix.

Partial mitigation — not a complete fix. The PHP project recommends upgrading. Disabling session upload progress blocks confirmed session paths in CVE-2026-109619; it does not cover other stale-state variants or CVE-2026-109618. Treat the installation as exposed until the update is verified.

Last verified against php.net advisory: 2026-10-21

Generate session.upload_progress configuration

Choose the configuration layer used by the website. This generator runs locally in your browser and does not modify your server. Apply its output in the existing configuration, then restart every affected worker.

; Partial mitigation only; upgrade PHP to fix both CVEs.
session.upload_progress.enabled=0

Where to apply the setting

  • php.ini: edit the file loaded by the web SAPI serving this domain. CLI and FPM can load different files.
  • PHP-FPM: put the generated directive inside the existing affected pool section; repeat for each affected pool.
  • Apache mod_php: put the directive in the server or VirtualHost configuration. This Apache directive is for mod_php, not Apache proxying to FPM.

Do not rely on ini_set() or FPM .user.ini: the setting needs to apply before request parsing. Save a backup first, check configuration syntax using your server's normal procedure, then restart the relevant PHP workers or Apache service.

Verify the running web configuration

  1. Have your host or administrator confirm session.upload_progress.enabled is disabled in the website's active web SAPI.
  2. Confirm every affected pool or worker was restarted. A CLI check does not establish what a web request loads.
  3. Test any upload-progress feature your application uses; disabling this setting can affect its progress display.
  4. Continue the PHP2Shell patch checklist. Do not interpret this configuration as a patched result.

Do not leave a public phpinfo() page behind to verify settings; it can disclose server configuration.

What this workaround does not cover

The stale global state vulnerability has variants beyond session upload progress. The out-of-memory corruption vulnerability is a separate path and remains in scope. The official advisory lists additional exposure-reduction measures, including a PHP 8.5-specific backtrace setting and request-size limits, but none replace the update.

The PHP project now publishes partial mitigation guidance. There is no complete workaround that makes an unpatched installation safe. Review the current official advisory with your administrator before combining changes.

Shared hosting: ask your provider

If you cannot edit the configuration or restart PHP workers, send the following request. Hosting panels may provide a per-domain setting; do not assume a setting for one domain covers all accounts.

Please update this domain's web PHP runtime for CVE-2026-109618 and CVE-2026-109619.
If the update cannot happen immediately, can you disable session.upload_progress.enabled
at the web SAPI configuration layer and restart all affected workers?
I understand this blocks only confirmed session paths and does not fix both CVEs.
Please confirm the running PHP version, SAPI and any vendor backported fixes.

Sources and next steps