{
  "id": 15877062,
  "title": "PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't",
  "url": "https://urgent.news/2026/10/21/php2shell-what-actually-protects-you-before-the-14-00-utc-php-rce",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T10:36:53.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html"
  },
  "original_language": "en",
  "account": "The PHP security firm GMO Flatt Security warned that you cannot completely block the two critical PHP flaws known as PHP2Shell before the planned fix, which will be released on October 21 at 14:00 UTC. The only workaround mentioned by the firm, session.upload_progress.enabled=0, is not sufficient on its own. To lower risk, you should take exposed PHP off the internet or behind access controls, limit what a compromised server can reach, and keep the update ready to apply as soon as it is available. No attacks have been reported yet. PHP has not disclosed which versions are affected, the specific part of PHP involved, or if changing a setting reduces the risk. The workaround setting is not a complete fix, as the firm later admitted, and attacks are expected to bypass it. PHP core developer Gina Peter Banyard emphasized that the only mitigation is patching or upgrading PHP. A code audit suggests the flaws may not exist in released PHP. A vendor still lists the setting as a mitigation, but others, like watchTowr, say there is no confirmed patch or workaround. To increase safety, turn off Session Upload Progress where it's not needed, confirm your update steps, restrict reach with a VPN or authenticated access, limit stored data and privileges on the server, and enable logging for investigation. For branches older than 8.2, upgrading or isolating the system is the best option.",
  "summary": "You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given no workaround of its own. Until you can install it, what lowers your",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}