cve

One idea for quick-fix. Not very tested. Use at your own risk. Patch up to latest PHP versions ASAP. …provided Apache has mod_security2 loaded and blocking is enabled. Use: SecRuleEngine On SecRequestBodyAccess On SecRule ARGS_NAMES “@rx (?i)^PHP_SESSION_UPLOAD_PROGRESS$” \ “id:10961801,phase:2,deny,status:403,log,msg:’PHP2Shell upload-progress blocked'” phase:2 lets ModSecurity parse the multipart body, then rejects it before Apache forwards the … Read more