Lower the max request size
This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.
What
post_max_size = 8M if your site doesn't take uploads, or post_max_size = 32M if it does.
Why
Smaller requests give an attacker less room to make PHP run out of memory.
Watch out
Forms or uploads bigger than this are rejected. The tool only ever lowers this value. If yours is already lower, it's left alone. Also keep upload_max_filesize below it.
Set it by hand
| Your setup | Where | Add this |
|---|---|---|
| Any (php.ini) | php.ini, or a new file in its conf.d folder | post_max_size = 8M |
| PHP-FPM | pool file, e.g. /etc/php/8.3/fpm/pool.d/www.conf | php_admin_value[post_max_size] = 8M |
| Apache mod_php | server or VirtualHost config | php_admin_value post_max_size 8M |
| Docker (official image) | your Dockerfile | RUN echo "post_max_size = 8M" >> /usr/local/etc/php/conf.d/99-php2shell.ini |
| Windows / XAMPP / IIS | php.ini in your PHP folder | post_max_size = 8M |
| Shared hosting | Ask your provider. .user.ini and .htaccess are not reliable for this (why). | |
Then restart PHP. Nothing changes until you do.
Undo
Run php php2shell.php --undo and pick the change. Or remove the line by hand and restart PHP.
Source: php.net