# PHP2Shell workaround falls short as PHP prepares October 21 fix

_Published Wednesday, October 21, 2026 at 8:51 AM EDT · Security · Latest · Tier 1 — Major_

![PHP2Shell workaround falls short as PHP prepares October 21 fix — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipzsA5sBIvBsTGT1YIrSeK_4YH5ISqTd40ZG1tV8YN1VkjjZuiY6CfQojYR-TIoYKM0EgZM4fYrmdtD25XjeTtgBkTFCQGny4DLL0fTKT5SEFpOFBcxNjLgif_FrX-1d-IX9DE58tQX6ELzGk4cWNpUpU5Eaig8pqdLL2h6qqVCC95ZmHFN6m7tD6m7BY/s1700-nu-rw-lo-l85-e365/php-rce-patch.jpg)

GMO Flatt Security has warned that disabling PHP's Session Upload Progress feature is not a complete fix for the two flaws called PHP2Shell, The Hacker News reported. PHP plans to release fixes at 14:00 UTC on October 21 for flaws it rates 9.2 out of 10.

Cloudflare says it has seen early exploitation attempts and deployed emergency firewall rules, which it describes as a stopgap. No compromise has been confirmed. PHP has not yet identified affected versions or confirmed a configuration workaround; fixed versions and full details are due with the release.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html)

---
Canonical: https://techandbusiness.org/newswire/CpyArjH8f6mNijFkHTEVAL
Published: 2026-10-21T12:51:01.274Z
Story chronology: 2026-10-21T10:36:53.000Z
Retrieved: 2026-10-25T06:17:35.042Z
Publisher: Tech & Business (techandbusiness.org)