noun 1. things which need to be put somewhere.

TL;DR If you run PHP older than 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 and can't patch yet, this should help mititgate your exposure to PHP2Shell. It does not fix the vulnerability (it is a stopgap until a real fix is available).

I have a bunch of old Apache/PHP sites running, and have never had time to bring them up to date with more recent PHP versions or isolate them inside a container. These are just informal resources I keep up for friends and whatnot, not "real" websites. Nevertheless, they are useful, and this PHP vulnerability could affect them.

What follows below is Debian/Ubuntu-centric, but the core ideas should be transferable.

CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") were disclosed on 2026-10-21. Both are rated CVSS 9.2 and allow unauthenticated remote code execution. Exploit code is apparently out there and has been seen in the wild.

or vendor backporting the fix (Ubuntu Pro ESM, Debian ELTS, etc.), which are not available at the time of writing (i.e. today, October 21 when the vulnerability was announced).

Only use this if you can live with both of these until a real fix is in place:

These measures reduce the risk; they don't remove it.

Create /etc/apache2/conf-available/block-multipart.conf to contain:

Temporary mitigation for CVE-2026-109618/109619 (PHP2Shell) - remove after patching

<If "%{HTTP:Content-Type} =~ m#multipart/form-data#i"> Require all denied </If>

Then add it to apache's configuration set: