Two critical PHP vulnerabilities known as PHP2Shell will be patched on October 21 at 14:00 UTC, with both flaws rated 9.2 out of 10 in severity. PHP has provided no official workaround, and the widely circulated configuration change disabling session upload progress is not sufficient protection on its own, according to the security firm that initially suggested it. Until the patch becomes available, administrators can reduce risk by taking exposed PHP applications offline, placing them behind access controls, or limiting what a compromised server can access. No attacks have been reported at this time.
The commonly recommended mitigation of changing the setting session.upload_progress.enabled to zero cannot be relied upon as a complete defense. Security researchers expect attackers may find ways around this measure, and the actual location of the vulnerabilities within PHP remains unconfirmed. A PHP core developer emphasized that patching or upgrading is the only reliable mitigation. For organizations unable to update immediately, CERT-EU recommends isolating internet-facing applications, while reducing server privileges and monitoring logs can minimize potential damage if a system is compromised before the fix is applied.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
