Keep the upload limit below the request limit
This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.
What
upload_max_filesize set below post_max_size. The tool uses 2M if you don't need uploads, or the size you tell it (under 32M) if you do.
Why
php.net: "Keep upload_max_filesize below post_max_size."
Watch out
Bigger files can't be uploaded. Need uploads of 32M or more? This mitigation doesn't fit your site, so update PHP instead.
Set it by hand
| Your setup | Where | Add this |
|---|---|---|
| Any (php.ini) | php.ini, or a new file in its conf.d folder | upload_max_filesize = 2M |
| PHP-FPM | pool file, e.g. /etc/php/8.3/fpm/pool.d/www.conf | php_admin_value[upload_max_filesize] = 2M |
| Apache mod_php | server or VirtualHost config | php_admin_value upload_max_filesize 2M |
| Docker (official image) | your Dockerfile | RUN echo "upload_max_filesize = 2M" >> /usr/local/etc/php/conf.d/99-php2shell.ini |
| Windows / XAMPP / IIS | php.ini in your PHP folder | upload_max_filesize = 2M |
| Shared hosting | Ask your provider. .user.ini and .htaccess are not reliable for this (why). | |
Then restart PHP. Nothing changes until you do.
Undo
Run php php2shell.php --undo and pick the change. Or remove the line by hand and restart PHP.
Source: php.net