GMO Flatt Security has warned that a widely shared PHP configuration change should not be treated as a complete defense against the two critical vulnerabilities known as PHP2Shell. PHP’s scheduled security release is due at 14:00 UTC on October 21, but affected versions and technical details had not yet been published at the time of reporting. The Hacker News reported the firm’s updated guidance.

The setting, session.upload_progress.enabled=0, disables PHP’s Session Upload Progress feature. GMO Flatt initially said it could not be sure the change fully addressed the flaws; in a later update, it clarified that the setting alone was not a complete fix and that attacks bypassing it were expected. PHP has not confirmed that the vulnerabilities are in this feature. A separate code audit also disputed whether the specific bug described in public reports exists in released PHP code.

A PHP core developer said the only mitigation she could confirm was patching or upgrading PHP, according to The Hacker News’ report. Other vendor guidance has continued to list the setting as an immediate mitigation, so its effectiveness remains disputed rather than established.

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619 and are rated critical with a CVSS v4.0 score of 9.2, according to Huntress’ assessment. Huntress reported that watchTowr had confirmed the flaws were real and reproduced CVE-2026-109618; that reproduction is reported by Huntress and is not independently established here. Huntress said it had not observed exploitation in its partner environments as of its October 20 publication.

PHP had not yet disclosed the affected or fixed versions. The project is expected to publish those details with the release. PHP supports four current branches, 8.2 through 8.5, while older branches may not receive upstream fixes, The Hacker News reported.

Until a fixed build is available, administrators should inventory PHP installations, prioritize internet-facing systems, place exposed applications behind VPN or allowlisted access where feasible, and limit PHP processes’ privileges, credentials and network reach. Huntress also recommends watching for PHP workers spawning shells, interpreters or download utilities. These steps reduce exposure and aid detection; neither source presents them as a confirmed workaround.