Server administrators should disable PHP’s session upload progress feature as an immediate precaution and prepare to install the official PHP security updates. Apply this configuration change to every PHP version and configuration used by hosted websites.
Why take action?
The PHP security team has announced an emergency release addressing two critical vulnerabilities, both rated CVSS v4.0 9.2. The issues are being discussed publicly as php2shell, under the identifiers CVE-2026-109618 and CVE-2026-109619. Check the official PHP announcement for release information and confirmed affected versions.
Independent research points to PHP’s session upload progress handling as a relevant attack surface. Disabling this feature is a precaution for that path; it should not be presented as verified protection against both vulnerabilities.
Disable session upload progress
Add or update the following setting in the effective PHP configuration:
session.upload_progress.enabled = OffOn servers hosting multiple PHP versions, apply the change to each version serving websites. Check for configuration overrides at the PHP pool, virtual host and site levels.
Restart or reload the relevant PHP services, using the procedure appropriate for your hosting stack, so that running workers pick up the change.
Verify the setting for hosted websites
Confirm that session.upload_progress.enabled is disabled in the PHP runtime actually serving each website. Checking command-line PHP alone is insufficient: PHP-FPM, LSAPI, Apache module and CLI configurations may differ.
This setting must be applied through PHP configuration. Changing it with ini_set() inside application code is not an effective mitigation: PHP processes upload progress before the application script executes. See the PHP upload progress documentation and session configuration reference.
Will file uploads still work?
Standard file uploads remain available. The change disables PHP’s session-based upload progress tracking. Applications using that feature to display an upload progress bar will lose that tracking functionality. Test any application that depends on it.
Use WAF protection as an additional layer
A targeted ModSecurity rule can reject multipart requests containing the configured upload progress field, normally PHP_SESSION_UPLOAD_PROGRESS. Such protection depends on correct request-body inspection and must block the request before it reaches PHP. A customized session.upload_progress.name requires a corresponding rule adjustment.
Treat WAF filtering as an additional mitigation, not a replacement for patching. Request parser differences and deployment configuration can affect coverage.
Install the official PHP security updates
Apply the official PHP security updates as soon as they become available from PHP or your supported package provider. Update every PHP version serving hosted sites, restart the relevant services and verify that websites are running the patched packages.
If a PHP branch is no longer supported, plan migration to a supported release rather than relying on temporary filtering indefinitely.
Reference: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities