Hardening Legacy PHP Against PHP2Shell When No Official Patch Exists
PHP2Shell is the nickname coverage gave a critical remote code execution class in PHP, reported on 25 and 26 October 2026. Millions of servers are reportedly exposed, including end-of-life branches that will never get an official upstream fix, and a public proof of concept is described as circulating. This video covers the containment side: how to inventory every PHP runtime you own by build provenance rather than version string, why the disable_functions list has to be set with php_admin_value instead of php_value, and how to layer WAF detection rules, open_basedir scoping, read-only filesystems and default-drop egress so a successful request lands somewhere useless. The full write-up has the discovery commands, the FPM pool directives, the staging test plan and the incident-response checklist: https://hackyjs.com/posts/hardening-legacy-php-against-php2shell-when-no-official-patch-exists Sourcing note, as stated in the post: the vulnerability description comes from secondary reporting and was not independently verified there. Exact CVE identifiers, precise affected version ranges and trigger conditions are not public in that material. Directive and configuration behaviour comes from the PHP manual and from testing the mitigation layer. No exploit is reproduced here. Treat this as defensive, lab-scoped guidance; confirm scope against the PHP project's security release notes, your distribution's security tracker and the Qualys stopgap guidance before you act.