PHP2Shell mitigations explained: what they do and don’t

First, php.net’s own warning

“If you cannot update immediately: while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.” (php.net)

So the plan is always the update (what to do). The settings below are for the hours or days in between, and they are applied by whoever manages the server.

Against CVE-2026-109618 (out-of-memory corruption)

Setting	What it does	What it costs
`memory_limit=-1`, set so apps can’t override it	Removes PHP’s own memory limit failure, the controllable trigger	No PHP memory cap: pair it with a container or cgroup limit
`post_max_size = 8M` (or `32M` with uploads)	Limits how much a request can make PHP allocate	Caps uploads (see below)
Limits at the web server or proxy	Rejects oversized or deeply nested requests before PHP	Configuration work

php.net on the first one: it “removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.” And on the safety boundary: “Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.” (php.net)

Against CVE-2026-109619 (stale state between requests)

session.upload_progress.enabled=0, then restart every worker. php.net: “This blocks the confirmed session paths but not other variants.” It also says: “Do not rely on ini_set() or FPM .user.ini.” (php.net)
On PHP 8.5, fatal_error_backtraces=0, then restart every worker: it blocks one confirmed path.
Fewer fatal errors and timeouts on pages an attacker can reach, and no invalid or deprecated settings applied per request. php.net adds: “Hiding diagnostics with error_reporting, display_errors or @ does not help.”

The 23 October advisory recommends the session setting once more, for a related issue: CVE-2026-115560.

What this means for a WordPress site

Uploads: WordPress allows the smaller of PHP’s upload_max_filesize and post_max_size (WordPress 7.1.2 source). With post_max_size = 8M, the Media Library refuses files over 8 MB. Expect that if your host applies this mitigation.
Sessions: WordPress itself doesn’t use PHP sessions, so the session setting doesn’t affect its core features.
Fatal errors: a plugin that often hits fatal errors or timeouts gives the second flaw more chances. The error log shows them (how).

None of this replaces asking your host for the update: what to ask your host.

Key takeaways

Mitigations reduce exposure; only the update fixes the flaws (php.net).
Against CVE-2026-109618: memory_limit=-1 set where apps can’t override it, a low post_max_size, request limits at the web server.
Against CVE-2026-109619: session.upload_progress.enabled=0, and fatal_error_backtraces=0 on PHP 8.5.
Every change needs a restart of all PHP workers; ini_set() and .user.ini don’t count.
post_max_size=8M also caps WordPress media uploads at 8 MB.

Frequently asked questions

Can I set these in WordPress or wp-config.php?

Not effectively. php.net says the session setting must be applied before request parsing and that ini_set() or .user.ini files don’t help. These belong in php.ini, the PHP-FPM pool or the web server configuration.

Does disabling session upload progress break WordPress?

Not WordPress itself: WordPress 7.1.2 never starts a PHP session; Site Health even warns when a plugin leaves one open. A plugin that shows upload progress through PHP sessions would lose that feature.

Isn’t memory_limit=-1 dangerous?

It removes PHP’s own memory cap, so php.net pairs it with a container or cgroup memory limit as the safety boundary, and warns against RLIMIT_AS and RLIMIT_DATA, which can trigger the vulnerable failure.

Check your own site before you upgrade

CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.

Get CompatNav on wordpress.org How it works

Sources

About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.