php2shell-2.2.conf

# Orbisius PHP Security — php2shell stopgap (CVE-2026-109618 / CVE-2026-109619), Apache 2.2.
# Blocks the vulnerable request shapes with a silent 404 before PHP parses the body, for a PHP
# you can't patch yet. STOPGAP, not a fix — update PHP, then remove this. Educational use, no
# warranty, you are responsible for what you deploy. Full setup, caveats and proof steps: README.
#
# EDIT the allowlist: replace 203.0.113.5 / 198.51.100.7 (they match nobody) with your admin IPs,
# one RewriteCond per IP. For a whole range use a regex prefix, e.g.
#     RewriteCond %{REMOTE_ADDR} !^192\.168\.
# Behind a CDN / proxy do NOT allowlist the proxy IP — block at the proxy instead; see the README.

# Reject a multipart or >=1MB body on any body-carrying method (not GET/HEAD) from a non-allowlisted client.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} !^(GET|HEAD)$
    # REPLACE both placeholder IPs below with your admin IPs — they match nobody as-is:
    RewriteCond %{REMOTE_ADDR} !=203.0.113.5
    RewriteCond %{REMOTE_ADDR} !=198.51.100.7
    RewriteCond %{HTTP:Content-Type} multipart/form-data [NC,OR]
    RewriteCond %{HTTP:Content-Length} [0-9]{7,}$
    RewriteRule ^ - [R=404,L,E=ORBISIUS_CVE_MULTIPART_BLOCK:1]
</IfModule>

# Optional backstop for a chunked large body (no Content-Length). On 2.2 this can only be GLOBAL
# — it caps admins too (the 2.4 edition caps per-IP). Uncomment to enable; keep it under ~1 MiB.
# LimitRequestBody 524288

# Disable PHP's session upload-progress feature (the CVE-2026-109619 chain), overriding php.ini even
# if it wasn't disabled there. mod_php only — the <IfModule> gates skip it under PHP-FPM (there,
# disable it in the FPM pool / php.ini). SERVER / VHOST ONLY: php_admin_flag is not valid in
# .htaccess (it errors), so omit this block there. See the README.
<IfModule php_module>
    php_admin_flag session.upload_progress.enabled Off
</IfModule>

<IfModule php7_module>
    php_admin_flag session.upload_progress.enabled Off
</IfModule>