PHP2Shell RCE Flaws: Workaround Insufficient Before October Patch

Two critical remote code execution flaws in PHP, collectively known as PHP2Shell, expose servers to unauthorised command execution. The vendor has scheduled a patch release for 14:00 UTC on 21 October. Until that update is installed, environments running PHP remain vulnerable to exploitation. Security researchers confirm that no temporary configuration change fully blocks these attacks.

Root cause

The vulnerabilities allow attackers to execute arbitrary code on the server. PHP has not disclosed the specific components involved or the technical mechanism behind the flaws. The vendor states that full details, including affected versions and the nature of the bugs, will be released alongside the fixed software. No independent researcher has verified the exact root cause prior to the patch.

Attack path

Attackers can exploit these flaws to gain remote code execution capabilities. The exact method of exploitation remains unknown as the vendor has withheld technical specifics. Researchers expect that attacks will bypass simple configuration changes. The primary risk is direct server compromise through web-facing PHP applications before the patch is applied.

Affected versions

The vendor has not specified which PHP versions are affected by PHP2Shell. No list of vulnerable releases has been published. The official advisory will include the affected version ranges when the patch is released on 21 October. Administrators cannot currently determine if their specific installation is at risk based on version numbers alone.

Mitigation

• Disable exposed PHP services on the internet or place them behind strict access controls.
• Limit network connectivity from compromised servers to reduce lateral movement.
• Prepare the update pipeline to apply the patch immediately upon release.
• Do not rely on the session.upload.progress.enabled=0 setting as a complete fix.

Signals worth monitoring

Teams usually review web server logs for unusual POST requests or large file uploads targeting PHP endpoints. Check whether outbound traffic from web servers connects to unfamiliar external hosts, which may indicate command and control activity. Monitor for abnormal process creation or new user accounts generated by the web service. Containment moves involve isolating affected hosts from the internal network and blocking outbound connections to unknown IP addresses while preserving forensic evidence.

Background: File upload vulnerabilities

Watch for unexpected file execution, odd filename characters, or storage directory traversal. Immediate signs include HTML injection in previews. Hidden signs involve MIME type mismatches and race conditions. Isolate the upload directory, enforce server-side validation, and rename files to random strings to prevent execution.

Read the full guide: File Upload Vulnerabilities: Warning Signs and Immediate Fixes

What to do and how to stay safe: PHP

• Verify that your patch management system is ready to deploy the October 21 update immediately.
• Review firewall rules to restrict access to PHP applications from untrusted networks.
• Monitor server logs for signs of unauthorised file uploads or remote code execution attempts.
• Prepare to isolate any server showing anomalous behaviour until the patch is confirmed.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does disabling session upload progress fix PHP2Shell?

No, security firms and core developers state this setting is not a complete mitigation and attacks can bypass it.

When is the PHP patch available?

The fix is scheduled for release at 14:00 UTC on 21 October.

Are there known attacks in the wild?

No attacks have been reported as of the time of the source material publication.