I initially updated the following php.ini setting and verified that it updated via phpinfo(). I understand this to be only a possible mitigation (see below).
session.upload_progress.enabled = Off
file_uploads = Off
According to someone stating they are one of the PHP release managers:
"INI settings alone won't protect you. You need to patch PHP."
I use Apache, and added an htaccess rewrite rule in my base directory to block all requests containing multi-part headers. Rewrite rules can also be added into Apache virtual host blocks. Accepting file uploads are not a critical function of the app in my case. This blocks multi-part form requests before they reach PHP.
I initially updated the following php.ini setting and verified that it updated via phpinfo(). I understand this to be only a possible mitigation (see below).
According to someone stating they are one of the PHP release managers: https://www.reddit.com/r/PHP/comments/1xb2utu/comment/phyu5m...I use Apache, and added an htaccess rewrite rule in my base directory to block all requests containing multi-part headers. Rewrite rules can also be added into Apache virtual host blocks. Accepting file uploads are not a critical function of the app in my case. This blocks multi-part form requests before they reach PHP.
And verified the non-block vs. block case. https://freeimage.host/i/nOqumyNI'm continuing to learn about the situation and may take the server offline as I learn more.
The writeup I found here:
https://jackalsyn.com/posts/php-up-2026.html
Content from a couple of my ChatGPT 6 Pro sessions about the issue:
https://chatgpt.com/share/6ad89ea3-b2f0-83ea-9c4c-2ecf5cc24b...
https://chatgpt.com/share/6ad8ad3d-3f6c-83e9-abf0-41da8a0d65...
https://en.wikipedia.org/wiki/PHP2Shell