PHP2Shell: What Website Owners and Small Businesses Should Do Right Now

After the update, restart. The University of Toronto's security team stresses that a patch does nothing until the running PHP processes are replaced, and that distribution packages may keep the old version number while carrying the fix, so check the vendor's advisory, not only the number.

How do I find every PHP install?

Small businesses tend to have more than they think: the main site, a staging copy, an old microsite, a webmail or database tool, a control panel. The Toronto advisory tells staff to hunt for departmental, lab, staging, archived and container deployments. Ask your developer or host for a list, and include anything that bundles its own PHP.

What if I am on PHP 8.1 or older?

PHP no longer releases fixes for those branches. The project published minimal source backports for 7.4, 8.0 and 8.1, aimed at people who build from source. Most owners will need either a vendor backport, as some Linux distributions and extended-support vendors offer, or a move to a supported release. PHP 8.2 itself stops getting security fixes on 31 December 2026, so aim higher if you are migrating anyway. Third-party patches exist, but Huntress says it cannot verify them. Do not run an unverified GitHub patch on a production server.

Which temporary fixes help, and what do they cost?

PHP says these reduce exposure and do not make a site safe. Set memory_limit to -1 in a way applications cannot override, which removes a guard against runaway scripts. Set post_max_size to 8M, or 32M if you need uploads, which will reject larger uploads. Turn session.upload_progress.enabled off and restart workers. Sansec adds that blocking multipart/form-data at the web server works for sites without uploads but breaks file uploads and can break checkout, so test it. Cloudflare's rules help only for traffic that actually goes through Cloudflare, per BleepingComputer.

What should I not do?

Avoid plugins or snippets that claim to fix PHP2Shell. Patchstack warns they are unverified and can break sites. Do not trust unofficial proof-of-concept code either: Tenable cautions that unverified code circulating may contain malware.

How do I tell if I was hit, and what to rotate?

Patchstack lists unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, oversized PHPSESSID cookies and unexplained worker restarts, none of which proves anything alone. Huntress points to web server processes launching shells or download tools, and to new files in the web root, new scheduled jobs and new accounts. Wiz showed that memory disclosure could expose passwords, tokens, API keys and certificates, so if a site was unpatched after 20 October, rotate database, admin, API and mail credentials after patching and keep logs. Larger teams should read our guide for hosts and security teams.

The realistic plan for a small business is simple: patch today, restart, verify, then plan the move off any end-of-life PHP before the next flaw arrives.