Fixes for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) have been available since 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On many systems the packages arrive later, for example on NAS devices such as Synology, where PHP comes through the Package Center. The blog mariushosting describes a Synology stop-gap based on a few PHP settings. Here I put them in context and show how to set them on Plesk and ordinary servers too.

First, important: this is not a fix

According to the PHP advisory only the update protects completely. Settings like the following reduce individual attack paths. They are a plaster for the time until the package arrives, not a replacement. As soon as your vendor ships a patched version (8.2.35, 8.3.36, 8.4.27 or newer), install it and only roll the stop-gap back if your application needs that.

The three settings

session.upload_progress.enabled = 0 : turns off the upload progress feature that works through the session.…