DE EN IT

~/blog / php2shell-workaround-php-ini

Mitigating PHP2Shell when no update exists yet: php.ini settings for NAS, Plesk and your own servers

· Daniele Michelin · ~3 min read · Also in DE · IT

Not every system gets the PHP fix on the same day. NAS vendors and some hosts often ship PHP packages later. For that time there is a stop-gap made of a few php.ini values. It does not replace the update, but it bridges the gap.

#php #security #patch #nas #hosting

Topics: DNS, mail & certificates

daniele@mikweb: ~/blog — less php2shell-workaround-php-ini.md

Fixes for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) have been available since 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On many systems the packages arrive later, for example on NAS devices such as Synology, where PHP comes through the Package Center. The blog mariushosting describes a Synology stop-gap based on a few PHP settings. Here I put them in context and show how to set them on Plesk and ordinary servers too.

First, important: this is not a fix

According to the PHP advisory only the update protects completely. Settings like the following reduce individual attack paths. They are a plaster for the time until the package arrives, not a replacement. As soon as your vendor ships a patched version (8.2.35, 8.3.36, 8.4.27 or newer), install it and only roll the stop-gap back if your application needs that.

The three settings

  • session.upload_progress.enabled = 0: turns off the upload progress feature that works through the session. That mechanism processes data already during the upload, so switching it off is the first measure.
  • session.use_only_cookies = 1 and session.use_cookies = 1: session IDs are only accepted via cookies, not via URL or form fields.
  • session.use_strict_mode = 1: PHP does not adopt a session ID it did not issue itself.

Side effect: applications that build an upload progress bar from PHP sessions will no longer show it. The upload itself keeps working.

How to set them

Synology Web Station: open Web Station, “Script Language Settings” on the left, choose the PHP profile, “Edit”, “Core” tab. Set session.upload_progress.enabled from 1 to 0 and the three session.use_* values to 1. Then check that your website really uses this profile (Web Service in the sidebar). The source blog states the effect for PHP 8.4, 8.3, 8.2, 8.0 and older.

Plesk: domain, “PHP Settings”, field “Additional directives”:

session.upload_progress.enabled=0
session.use_only_cookies=1
session.use_cookies=1
session.use_strict_mode=1

Your own server: create a file in the conf.d of the affected PHP version (for example 99-php2shell.ini) and restart PHP-FPM or Apache.

Containers: mount the file as an ini into the image (volume to /usr/local/etc/php/conf.d/) and restart the container.

Check that it works

php -i | grep -E "session.upload_progress.enabled|session.use_(cookies|only_cookies|strict_mode)"

That shows only the CLI values. For the website itself, briefly open a small page with phpinfo() and delete it afterwards, or check the domain's settings in Plesk. Important: restart PHP after the change.

Other measures that are mentioned

According to the report by The Hacker News, the PHP team additionally suggests for CVE-2026-109618 to set memory_limit=-1 (so applications cannot override it), keep post_max_size low and enforce size limits at the web server already. Read the advisory and test whether your applications can live with those values.

My recommendation

  • First check which PHP version really runs and whether a patched build exists.
  • If not: set the stop-gap, test the application, leave a dated note.
  • Check the Package Center or your host regularly and install the update as soon as it appears.
  • Where possible switch to a handler with timely updates, as I described in my post on the PHP emergency patch.

Source of the Synology guide: mariushosting.

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time.

daniele@mikweb: ~/blog — ls

More articles

PHP emergency patch (PHP2Shell): how to check and patch your serversTwo critical PHP flaws, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35: where PHP really runs, how to check the version, patch and restart — with a worked example.DNS migration without downtime: TTL, order of steps and a checklist for domain and hosting movesSwitch hosting, DNS provider or registrar without losing website or e-mail: lower the TTL early, copy the zone, test before the cutover.Mail landing in spam: SPF, DKIM and DMARC alignment explainedSPF passes but mail still lands in spam? Why DMARC needs alignment, how to read mail headers and how to roll out SPF, DKIM and DMARC in order.

← All articles