How to patch PHP2Shell

The only complete fix is a patched PHP build, then a restart. Your host or system administrator does that work. Cprofessionals does not patch PHP on your server. The steps below are the ones PHP, Tag1, CISA and AWS have published. Temporary ini changes are included only as the stopgaps PHP itself listed, and they are not a fix.

1. Identify the PHP version the web server runs (Drupal Status report, WordPress Site Health, or a phpinfo page served by the site). The CLI php -v can differ. (Tag1)
2. On shared or managed hosting, choose the newest PHP in the panel and ask the host to confirm the patched build and a restart.
3. On a VPS (Ubuntu/Debian), install the distro security update. Tag1 cites Ubuntu USN-8948-1/-2 and Debian DSA-6574-1 / DLA-4848-1. Verify with the package manager, not only php -v. (Tag1)
4. In Docker, pull fresh official images and rebuild. Running containers keep the old PHP. (Tag1)
5. Restart Apache (mod_php), PHP-FPM and long-running workers.
6. On PHP 8.1 or older, use a vendor backport, the PHP security team's source backports for 7.4, 8.0 and 8.1, or upgrade. Skip 8.2 when you upgrade. It ends December 31, 2026. (php.net, Tag1)
7. If you truly cannot update yet, PHP's own advisory lists temporary measures that reduce exposure and "do not make an installation safe": set session.upload_progress.enabled=0 in php.ini, the FPM pool, or Apache config (not ini_set); set memory_limit=-1 via php_admin_value plus a container or cgroup limit; set post_max_size to 8M (or 32M if you need uploads); set fatal_error_backtraces=0 on 8.5; then restart every worker. These are not a fix. (php.net)
8. After patching, rotate secrets. Review logs from October 17 for PHP_SESSION_UPLOAD_PROGRESS POSTs and unexpected processes. (AWS)

If the site is already down, an overnight rebuild is a migration, not a PHP patch. Emergency migration pricing.