A moron has released a POC early for php2shell so here is what you need to do: If you’re on version prior to 8.2: Edit php.ini: session.upload_progress.enabled = Off Then reload php-fpm and restart apache If you’re on later version: Update (it’ll be available in a few hours) In any case, the mitigation for the php.ini should work either way. Not sure if it’ll cover both vulns though so keep an eye on that. I’ll be reporting on follow up activity on windows as a target. Good luck!