On October 20, the PHP security team announced two critical vulnerabilities, each rated CVSS 9.2. Fixes are scheduled for October 21 at 14:00 UTC.
We don’t yet know the full technical details. What we do know is that updating WordPress or WooCommerce won’t fix vulnerabilities in PHP itself. Your hosting provider needs to update the underlying PHP installation.
Until that happens, there are a few things worth doing.
1. Block suspicious uploads at the CDN
Early security research points to PHP’s session upload progress feature and specially crafted multipart/form-data requests. PHP hasn’t confirmed this as the cause, but we can already reduce exposure.
If your CDN supports request body inspection, block multipart POST requests containing the field PHP_SESSION_UPLOAD_PROGRESS. That’s the default field PHP uses to activate upload progress tracking.
As an example, on Bunny, you can configure this through Shield custom WAF rules.
Alternatively, use CDN Edge Rules to block multipart POST requests outside known upload paths. This is less precise and must be tested against your actual site comprehensively. WordPress plugins may accept file uploads through contact forms, product customization, or custom API endpoints.
Before blocking anything, test your checkout, media uploads, and any customer forms that accept files. Also make sure attackers cannot bypass your CDN and reach the origin server directly – but that’s relevant independent of the PHP2Shell CVE.
2. Disable PHP upload progress tracking
PHP enables session upload progress by default. WordPress core doesn’t require this feature, although individual plugins might.
You can disable it in your PHP configuration:
session.upload_progress.enabled = Off
The easiest way is through your hosting panel. On PHP-FPM installations, you may also use .user.ini. Apache installations using mod_php can configure it through .htaccess.
Verify the setting through PHP running on your website, not the command line. A temporary PHP script calling ini_get('session.upload_progress.enabled') works. Remove that script after checking.
Disabling this feature should not stop normal file uploads. It only disables PHP’s session-based progress tracking.
Important: This addresses a suspected attack path. It is not a confirmed fix for both vulnerabilities.
3. Prepare for the patch
While waiting for your host, check three things:
- Your store has a recent backup stored outside the web server, and you know it restores.
- Unused administrator accounts and API credentials have been removed.
- Your hosting provider plans to deploy the PHP security release.
Once the patch becomes available, update PHP as soon as your host provides it.
The CDN rules can remain useful afterward, provided they don’t interfere with legitimate uploads.
The important distinction is simple: these measures reduce your exposure. Only the PHP security fix addresses the underlying vulnerabilities.
This is also a good moment to check the PHP version on your server. Many sites are still running outdated PHP versions such as PHP 7.4 or even older. Make sure to upgrade.
Leave a Reply