The PHP Foundation says the third PHP2Shell bug needs an unlikely setup and won’t get an emergency fix. It also gives a one-line mitigation. Here’s a generic checklist for applying it on a Linux web server. It assumes you’ve already patched for the first two bugs (see my patching how-to).
1. Find the php.ini your web server actually uses
The CLI and the web server often load different files. Check both:
php --ini
php -i | grep -i 'session.upload_progress.enabled'For PHP-FPM or mod_php, a temporary phpinfo() page shows the “Loaded Configuration File” and the current value. Delete that page right after.
2. Turn off session upload progress
This is the setting PHP’s advisory recommends until the next regular release:
session.upload_progress.enabled = 0Put it in the php.ini (or a conf.d drop-in) for each PHP version and SAPI you run.
3. Restart PHP so the change takes effect
sudo systemctl restart php-fpm # or php8.x-fpm on Debian/Ubuntu
sudo systemctl restart apache2 # if you use mod_php (httpd on some distros)4. Verify
Re-check the value through the web server, not just the CLI, and make sure your site still loads. Most apps don’t use upload progress, but if yours shows upload progress bars, test those.
5. Check your app code
The risky pattern is code that calls ini_set('session.serialize_handler', 'php') at runtime before session_start(). A quick search helps:
grep -rn "serialize_handler" /path/to/your/app6. Watch for the regular release
When the next PHP bugfix release ships with the full fix, update, restart PHP, and decide whether to turn the setting back on.
Have a blessed day! And Happy Hacking!
