Mmastodon TechnologyCybersecurity first seen 2 d ago, last 2 d ago, peak #7

PHP2Shell vulnerability actively exploited, admins share Nginx stopgap

Original: 1/4 PHP2Shell is actively exploited. If you can't patch every container tonight, here is a raw Nginx stopgap. It blocks

Security practitioners are warning that the PHP2Shell vulnerability is being actively exploited and that not all environments can be patched quickly. A workaround is circulating that uses an Nginx rule to block the PHP_SESSION_UPLOAD_PROGRESS payload at the edge, returning a connection drop (444) before it reaches vulnerable containers. Admins running containerised PHP who cannot patch every instance tonight are being urged to apply the filter as an interim measure.

Why now: An actively exploited PHP flaw with no immediate patch path for some setups is prompting urgent sharing of mitigations.

PHPNginxPHP2Shell

Open on mastodon →

Evidence

• 1/4 PHP2Shell is actively exploited. If you can't patch every container tonight, here is a raw Nginx stopgap. It blocks the PHP_SESSION_UPLOAD_PROGRESS payload at the edge and returns 444. Config here: https://www. kernelshield.dev/p2shell/ # PHP2Shell # Nginx # InfoSec # DevOps · admin@adalta.social · 3

API: https://socialmediatrends-api.osmike.com/v1/trends/3756116