Your setup

Where the config lives and how to restart PHP afterwards.

PHP-FPM (Nginx, or Apache with FPM)

Config: /etc/php/8.x/fpm/php.ini and conf.d/ (Ubuntu/Debian), or /etc/php.ini and /etc/php.d/ (Red Hat). Pool files: /etc/php/8.x/fpm/pool.d/ or /etc/php-fpm.d/.

Restart: sudo systemctl restart php8.3-fpm (Red Hat: php-fpm)

Apache with mod_php

Config: /etc/php/8.x/apache2/php.ini. For memory_limit, also add php_admin_value memory_limit -1 to the Apache config so apps can't change it.

Restart: sudo systemctl restart apache2 (Red Hat: httpd)

Windows IIS

Config: php.ini in your PHP folder (e.g. C:\Program Files\PHP\8.3\).

Restart: iisreset as Administrator

XAMPP, MAMP, Laragon, Homebrew

XAMPP: C:\xampp\php\php.ini. MAMP: /Applications/MAMP/bin/php/<ver>/conf/php.ini. Homebrew: /opt/homebrew/etc/php/8.x/php.ini.

Restart from the app's control panel, or brew services restart php.

Docker

Don't edit a running container: changes vanish when it's recreated. Put the settings in your image:

RUN { echo "memory_limit = -1"; echo "post_max_size = 8M"; \
      echo "upload_max_filesize = 2M"; echo "session.upload_progress.enabled = 0"; } \
    > /usr/local/etc/php/conf.d/99-php2shell.ini

Better: bump the image tag to a fixed PHP version and rebuild.

Shared hosting

Your provider controls PHP. .htaccess and .user.ini settings may be ignored, and php.net says not to rely on .user.ini for these bugs because it loads too late. Do this instead:

  1. Pick the newest PHP version in your hosting panel.
  2. Ask your provider: "Is the PHP serving my site patched for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)?"