The playbook
The response, step by step
Fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. An update only counts once the service restarts.
In order
1
Find every system that runs PHP.
Websites, internal tools, suppliers, vendor appliances and the images you build from.
2
Patch internet-facing first.
mod_php, then FPM, then the rest. Restart every worker; rebuild every image.
3
Bound the known paths.
Each temporary setting blocks a path; none is a fix.
4
Watch the process tree.
Alert on a PHP worker spawning a shell or a downloader.
5
Decide who calls isolate or offline, and when.
Two US agencies say take it offline if it cannot be updated.
Fixed versions, and the settings until you are there
Fixed in8.5.12 · 8.4.27 · 8.3.36 · 8.2.35memory_limit=-1, set where applications cannotRemoves the controllable memory-limit failure; an underlying allocation failure can still reach the vulnerableA low post_max_size (8M without uploads, 32M wReduces exposure to specific attack paths; does not make an installation safe.A container or cgroup memory limit as an availDo not use RLIMIT_AS or RLIMIT_DATA: they can cause the vulnerable allocation failure.session.upload_progress.enabled=0 in php.ini, Blocks the confirmed session paths only. ini_set() and .user.ini are too late.That is the page for you.