Jacob Ayokunle

Here is a full list of what you can do NOW for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) as a temporary mitigation. (generated and validated by LLM) 1️⃣ Do this first. In php.ini or the FPM pool, set: session.upload_progress.enabled = 0 Reload PHP-FPM, then update PHP right after the release (21 Oct, 14:00 UTC). 2️⃣ Edge block until you patch. It blocks the PHPSESSID cookie and query (also lowercase and URL-encoded), and all multipart/form-data requests. ⚠️ File uploads stop working until you remove it. ☁️ Cloudflare (WAF custom rule, action Block): (lower(url_decode(http.cookie)) contains "phpsessid") or (lower(url_decode(http.request.uri.query)) contains "phpsessid") or (any(lower(http.request.headers["content-type"][*])[*] contains "multipart/form-data")) 🟩 nginx (http {} context): map "$http_cookie|$args|$content_type" $block_php2shell { default 0; "~*(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)" 1; "~*multipart/form-data" 1; } In each server {} block: if ($block_php2shell) { return 403; } 🔒 Caddy: @php2shell expression `{header.Cookie}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {query}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {header.Content-Type}.matches("(?i)multipart/form-data")` respond @php2shell 403 🚦 Traefik v3 (Coolify: Server > Proxy > Dynamic Configurations). Add this to the https router and also to a copy for the http entrypoint: http: routers: block-php2shell: rule: "HeaderRegexp(`Cookie`, `(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)`) || QueryRegexp(`PHPSESSID`, `.*`) || HeaderRegexp(`Content-Type`, `(?i)multipart/form-data`)" priority: 100000 entryPoints: [https] middlewares: [deny-all] service: noop@internal tls: {} middlewares: deny-all: ipAllowList: sourceRange: ["255.255.255.255/32"] ✅ Test: curl -s -o /dev/null -w '%{http_code}\n' -H 'Cookie: PHPSESSID=x' https://your-app → 403 curl -s -o /dev/null -w '%{http_code}\n' -F a=b https://your-app → 403 The edge block does not protect direct origin access. Disable upload_progress and patch PHP.