THE Hacker News reports that two critical PHP flaws, collectively dubbed PHP2Shell, are unpatched but scheduled to be fixed in a PHP release at 14:00 UTC on 21 October 2026. PHP rates both flaws at 9.2/10 and has not published fixed versions or the exact affected components yet. At the time of writing, no exploitation had been publicly reported, and PHP indicated that details would accompany the release. The guidance emphasises reducing exposure and preparing to patch promptly once the update lands, rather than relying on any interim workaround.
A proposed workaround circulating online—setting session.upload_progress.enabled to 0—was shown to be ineffective as a standalone protection. GMO Flatt Security initially suggested it might help, but later stated that the change is not a complete fix and that attacks might still succeed. A PHP core developer echoed this assessment, noting that patching or upgrading PHP is the only reliable mitigation.
The article also describes competing opinions: some vendors continue to promote the setting as an immediate mitigation, while others warn there is no confirmed patch or workaround at this time. The piece stresses that the flaw’s location within PHP and the impacted versions remain unconfirmed until PHP’s release, and it highlights that other defensive steps (isolating internet-facing services, limiting privilege, restricting access at the edge, and ensuring robust logging) should be considered in the interim.
It notes that fixes are expected only for PHP branches 8.2 through 8.5, with exact versions to be announced alongside the advisory.