PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
Summary: PHP plans to release a fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has issued no workaround of its own. The session.upload_progress.enabled=0 setting that spread on social media was walked back by the firm that suggested it, GMO Flatt Security, which said the setting alone is not a complete fix and that attacks getting around it are expected.
Why it matters: PHP core developer Gina Peter Banyard said the only mitigation is patching or upgrading, and release manager Joe Ferguson said ini settings won't save you - so any organization treating the upload-progress setting as a shield is exposed until the fix lands and is applied to the runtime that actually serves web traffic.