Turning off upload progress is not a PHP2Shell fix

Within an hour of PHP’s patches landing, the same advice was everywhere:

Set session.upload_progress.enabled = 0 and you’re safe.

You’re not. It’s a stopgap, not a fix.

Why it doesn’t cover you

It only touches one of the two flaws. PHP2Shell is two bugs. CVE-2026-109618 is about running out of memory and has nothing to do with upload progress.
Within the other flaw, it blocks one route in. PHP’s advisory for CVE-2026-109619 says the setting “does not mitigate the other lifecycle paths”. Warnings raised while PHP applies its settings at start-up are a second confirmed route.
PHP says it plainly: “There are no complete mitigations, updating is the only safe choice.”

The setting is still worth using in the meantime, as long as it’s set properly:

Put it in php.ini or your PHP-FPM pool configuration, so it applies before PHP parses the request. Setting it in .user.ini or with ini_set() does nothing here, because those are read too late.
Restart every PHP worker afterwards.
On PHP 8.5, also set fatal_error_backtraces = 0.

; /etc/php/8.4/fpm/conf.d/99-php2shell-stopgap.ini
session.upload_progress.enabled = 0

sudo systemctl restart php8.4-fpm
php-fpm8.4 -i | grep upload_progress.enabled   # should say Off

Then don’t mark the server as fixed. You’re fixed when you’re on 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your vendor’s patched build.