Turn off session upload progress
This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.
What
session.upload_progress.enabled = 0
Why
This feature is one confirmed way to reach CVE-2026-109619. It must be set in config that loads before the request is read: php.ini, the PHP-FPM pool or the server config. Not ini_set() and not .user.ini, which load too late.
Watch out
Upload progress bars that read from $_SESSION stop working. Most sites don't use them.
Set it by hand
| Your setup | Where | Add this |
|---|---|---|
| Any (php.ini) | php.ini, or a new file in its conf.d folder | session.upload_progress.enabled = 0 |
| PHP-FPM | pool file, e.g. /etc/php/8.3/fpm/pool.d/www.conf | php_admin_flag[session.upload_progress.enabled] = off |
| Apache mod_php | server or VirtualHost config | php_admin_flag session.upload_progress.enabled off |
| Docker (official image) | your Dockerfile | RUN echo "session.upload_progress.enabled = 0" >> /usr/local/etc/php/conf.d/99-php2shell.ini |
| Windows / XAMPP / IIS | php.ini in your PHP folder | session.upload_progress.enabled = 0 |
| Shared hosting | Ask your provider. .user.ini and .htaccess are not reliable for this (why). | |
Then restart PHP. Nothing changes until you do.
Undo
Run php php2shell.php --undo and pick the change. Or remove the line by hand and restart PHP.
Source: php.net