PHP2Shell: No Full Workaround Exists Before Today's PHP Patch
Two critical PHP flaws, named PHP2Shell and rated 9.2 of 10, will be fixed at 14:00 UTC on October 21. No official workaround exists, and a circulating setting is not enough alone.
Key points
- Two critical PHP flaws, called PHP2Shell, are rated 9.2 out of 10.
- PHP will release the fix at 14:00 UTC on October 21.
- PHP has not published a workaround of its own.
- A setting circulating as a workaround is not sufficient on its own, according to the firm that suggested it.
- The flaws cannot be fully blocked until the patch is installed.
What is known
Two critical flaws in PHP, referred to as PHP2Shell, are due to be fixed by the PHP project at 14:00 UTC on October 21. Both are rated 9.2 out of 10. The project has not offered a workaround of its own.
A single configuration setting has been passed around as a stopgap. The security firm that originally suggested it now says it is not enough by itself, and that the flaws cannot be fully blocked before the fix is available.
What this means for institutions
The source excerpt does not detail affected versions, exploitation status or the full list of partial mitigations, so teams should not assume any single setting makes a system safe. The practical position is to prepare for a fast patch, reduce exposure where possible, and avoid relying on the circulating setting as protection.
Organisations that run PHP-based web applications, portals or customer-facing services should treat this as a priority change once the release is published.
Next steps
Use the time before release to identify where PHP runs, confirm who owns each system, and agree an emergency change window so the update can be tested and deployed promptly after publication.
What to do now
- Inventory all systems and applications running PHP, including third-party and hosted ones.
- Do not treat the circulating configuration setting as sufficient protection.
- Prepare an emergency change window and testing plan for after 14:00 UTC on October 21.
- Apply the official PHP fix promptly once published, starting with internet-facing systems.
- Increase monitoring of PHP-based web applications until patching is complete.
How useful was this story?
0.0 out of 5 · 0 ratings
Our consultants can assess your exposure and map the change to your controls and evidence.