php2shell-2.4.conf

# Orbisius PHP Security — php2shell stopgap (CVE-2026-109618 / CVE-2026-109619), Apache 2.4.
# Blocks the vulnerable request shapes with a silent 404 before PHP parses the body, for a PHP
# you can't patch yet. STOPGAP, not a fix — update PHP, then remove this. Educational use, no
# warranty, you are responsible for what you deploy. Full setup, caveats and proof steps: README.
#
# EDIT the allowlist: replace 203.0.113.5 / 198.51.100.7 (they match nobody) with your admin IPs
# or CIDR ranges, in BOTH the RewriteCond and the <If>. -R takes a single IP or a CIDR range.
# Behind a CDN / proxy do NOT allowlist the proxy IP (it exempts everyone) — see the README.

# Reject a multipart or >=1MB body on any body-carrying method (not GET/HEAD) from a non-allowlisted client.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} !^(GET|HEAD)$
    # REPLACE both placeholder IPs below with your admin IP/CIDR — they match nobody as-is:
    RewriteCond expr "! (-R '203.0.113.5' || -R '198.51.100.7')"
    RewriteCond %{HTTP:Content-Type} multipart/form-data [NC,OR]
    RewriteCond %{HTTP:Content-Length} [0-9]{7,}$
    RewriteRule ^ - [R=404,L,E=ORBISIUS_CVE_MULTIPART_BLOCK:1]
</IfModule>

# Cap non-allowlisted request bodies at 512 KB (admins exempt) — catches a chunked large body
# the header rule misses. Keep it under ~1 MiB. See the README for the PHP-FPM caveat.
# REPLACE both placeholder IPs below with your admin IP/CIDR — they match nobody as-is:
<If "! (-R '203.0.113.5' || -R '198.51.100.7')">
    LimitRequestBody 524288
</If>

# Disable PHP's session upload-progress feature (the CVE-2026-109619 chain), overriding php.ini even
# if it wasn't disabled there. mod_php only — the <IfModule> gates skip it under PHP-FPM (there,
# disable it in the FPM pool / php.ini). SERVER / VHOST ONLY: php_admin_flag is not valid in
# .htaccess (it errors), so omit this block there. See the README.
<IfModule php_module>
    php_admin_flag session.upload_progress.enabled Off
</IfModule>

<IfModule php7_module>
    php_admin_flag session.upload_progress.enabled Off
</IfModule>