Built-in protections are now the PortWall patches on the Virtual Patches page, next to the patches you write yourself. See Virtual patches for how they work, how to switch them and how they end.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
The first PortWall patch, PW-2026-0001. Two critical flaws in PHP itself, disclosed on 21 October 2026, let a crafted form post or upload to any PHP page run code on the server. PortWall refuses the requests the attacks need:
- a form or upload that carries PHP's upload-progress field (
PHP_SESSION_UPLOAD_PROGRESS); - a form with more than 1,000 fields;
- an upload of more than 100 files at once;
- a form field nested more than 16 levels deep.
A normal form or upload is not affected, and sites that do not run PHP never see such a request.
Updating PHP is the only complete fix: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. Until every server is updated, setting session.upload_progress.enabled=0 in php.ini closes the upload-progress path as well.
Its switch for every site, and for each site, is on Virtual Patches, under PortWall patches. A site's own page no longer has a panel for it; it shows how many patches are in force.