DEV Community

Cover image for PHP2Shell: what the two critical PHP RCE CVEs actually mean for your stack
Safdar Ali
Safdar Ali

Posted on

PHP2Shell: what the two critical PHP RCE CVEs actually mean for your stack

#php #security #webdev #cybersecurity

If you're on PHP 8.1 or older, there is no official fix coming. Those branches are end-of-life. Your options are: upgrade, or ask your hosting/distro vendor if they provide a backported patch (some LTS vendors do).

What to actually do today

1. Check what's really running your site, not just your CLI version

php -v
Enter fullscreen mode Exit fullscreen mode

This shows your CLI version. It is not necessarily the version serving requests. Check the SAPI that's actually live:

php-fpm -v
curl -sI https://yoursite.com/ | grep -iE "^(server|x-powered-by):"
Enter fullscreen mode Exit fullscreen mode

CLI and web versions can differ, especially on servers hosting multiple projects.

2. Patch internet-facing systems first

If it's reachable from the open internet, it's the priority. Internal-only services can wait a few hours if you're triaging a lot of infrastructure.

3. Don't forget bundled PHP

Docker base images, CMS installer bundles, and vendor tarballs often ship their own PHP. A host-level patch won't touch these. Check every running image:

docker exec <container> php -v
Enter fullscreen mode Exit fullscreen mode

4. Ask your hosting provider directly

Managed hosts (SiteGround, Cloudflare-fronted setups, etc.) may have already deployed WAF-level mitigations or patched server-side. Don't assume — ask.

5. Watch for post-exploitation signs

Keep an eye on PHP worker processes spawning shells, curl/wget calls, or unexpected outbound connections. That's the pattern seen in active exploitation so far.

A stopgap, not a fix

Some researchers have floated disabling session.upload_progress as a temporary mitigation:

session.upload_progress.enabled = Off
Enter fullscreen mode Exit fullscreen mode

This is not a substitute for patching. Treat it as something you do while you're rolling out the real fix, not instead of it.

If you manage sites for other people

Send a short, plain update today — what happened, what you're doing about it, when it'll be done. Clients hearing about a "PHP vulnerability" from the news before they hear it from you is a worse conversation than this one.

Sources:

Has your stack been patched yet? Drop your setup in the comments — curious how many people are finding PHP buried in places they forgot about.

Top comments (0)