PHP2Shell Mitigation on Unsupported or Legacy PHP versions

PHP2Shell on Unsupported PHP Versions: An Alternative Mitigation

For legacy PHP installations where official security updates are unavailable, particularly PHP 5.6, PHP7.4, PHP–8.1, an open-source extension developed by Hosted Power offers a possible alternative to upgrading the entire PHP runtime to fix PHP2Shell.

HOSTED-POWER/php_uploadprogress_guard is a lightweight PHP extension designed to mitigate both PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) without rebuilding PHP or modifying application code.

Unlike simply disabling session.upload_progress.enabled, the extension implements several protections based on the official PHP security fixes:

Detaches the vulnerable session upload-progress callback and prevents applications from re-enabling it.
Replaces the multipart parser with a hardened implementation that limits memory amplification and enforces request-size restrictions.
Adds safeguards against unsafe out-of-memory handling and stale request state.
Preserves normal file uploads, $_POST, $_FILES, and session functionality.

According to its developers, version 3.1.0 supports PHP 5.6 through 8.5, including environments using Remi, Sury, cPanel EA4, DirectAdmin, and official PHP Docker images. PHP 5.4 and 5.5 can also be built from source.

Installation

The repository provides prebuilt binaries for x86_64 non-thread-safe PHP installations, along with source code and Ansible deployment examples.

To compile against an existing PHP installation:

git clone https://github.com/HOSTED-POWER/php_uploadprogress_guard.git
cd php_uploadprogress_guard/src

phpize
./configure
make
sudo make install

Ensure that phpize and php-config correspond to the PHP version being protected. Then enable the extension in the relevant PHP configuration:

extension=hp_uploadprogress_guard.so

Restart PHP-FPM or Apache and verify:

php --ri hp_uploadprogress_guard

The output should report the active protection mechanisms, including the detached upload-progress handler and hardened parser. Verify the extension is also loaded in the actual web-serving PHP process, not only the CLI.

The extension also provides an emergency mode:

hp_uploadprogress_guard.mode = block

This blocks all multipart/form-data requests with HTTP 415, including legitimate file uploads. Use it only when that disruption is acceptable.

Security Considerations

This is a third-party mitigation, not an official PHP security patch. Although the developers report successful testing across multiple PHP versions and hosting environments, equivalent protection against every exploitation scenario has not been independently established.

The extension modifies low-level PHP behavior and should be tested against production workloads before deployment. Use a current, reviewed release; early versions had compatibility issues that were subsequently corrected.

For end-of-life PHP installations that cannot be upgraded immediately, this extension may provide meaningful protection against PHP2Shell. However, it does not address other vulnerabilities in unsupported PHP versions.

Prefer vendor-patched PHP packages whenever available, and treat the extension as a temporary mitigation rather than a long-term replacement for supported PHP.

References: