rtuin's comments

rtuin · 2026-10-21T09:26:40 1792574800

Did you successfully run a RCE test, or only a vulnerability check? So far all write-ups and PoC's i've found fail to "cash in" on the RCE part.

system2 · 2026-10-21T09:35:18 1792575318

I was able to bring it to the point of memory corruption. It is 3 am where I am now; I will continue in the morning. As a precaution, I configured .htaccess rule.

  # BEGIN php2shell-mitigation
  
  RewriteEngine On
  RewriteCond %{HTTP:Content-Type} multipart [NC]
  RewriteRule .* - [F,L]
  
  
  Require all denied
  
  # END php2shell-mitigation

I added a rewritecond to ignore multipart before php-fpm receives anything. I did a similar thing for nginx servers. Also in .user.ini added "session.upload_progress.enabled = Off".

These two seem to do the trick, but again I am not 1000% sure until tomorrow morning's deeper dive. My eyes are burning, and I can't sleep because of the stress this exploit.

Macuyiko · 2026-10-21T09:48:13 1792576093

I've done the same in caddy:

@multipart header_regexp Content-Type (?i)multipart respond @multipart 403

@uploads_php path_regexp uploads_php ^/(?:./)?wp-content/uploads/.\.php(?:/.*)?respond @uploads_php 404

Plus the php.ini changes, "session.upload_progress.enabled = Off" and strict mode. Let's hope it holds until then

bombcar · 2026-10-21T10:40:59 1792579259

    @multipart header_regexp Content-Type (?i)multipart
    respond @multipart 403

    @uploads_php path_regexp uploads_php ^/(?:.*/)?wp-content/uploads/.*\.php(?:/.*)?
    respond @uploads_php 404

rtuin · 2026-09-28T18:14:09 1790619249

Any benchmarks other than computer use/agentic coding published yet? Curious to compare more broadly with other models