All notes
Security
- PHP2Shell, in plain EnglishSecurityA
Two critical flaws in PHP itself let attackers run code on a server without logging in. What they are, why a login page doesn’t help, and what to do.
- Is your WordPress site affected by PHP2Shell? A two-minute checkSecurityA
Find your site’s PHP version from the WordPress dashboard, then follow the path that applies to you.
- Turning off upload progress is not a PHP2Shell fixSecurityA
Setting session.upload_progress.enabled = 0 is a useful stopgap, but it blocks one route into one of the two flaws. PHP’s own advisories say so.