PHP2Shell: Intercube’s hosting response

Intercube disabled session.upload_progress.enabled on the PHP services covered by this rollout. This turns off PHP’s session-based upload-progress tracking. The PHP manual explains that the feature writes progress information into a session before application scripts execute. Disabling it removes that processing from these runtimes as a temporary precaution.

Our engineers checked the configuration, restarted the affected services under controlled conditions and verified the effective setting through live PHP requests. We also tested ordinary file uploads before and after the change. Those uploads succeeded. The application’s PHP branch stayed the same.

PHP still needs the official security update. PHP core developer Gina Peter Banyard has stated that patching or upgrading PHP is the only mitigation. The configuration change is a precaution alongside that work, and our engineers have prepared the runtime patch procedure.

A production application depends on more than the PHP version shown in a terminal. Web requests, background workers and scheduled tasks can use different runtime configurations. A hosting partner needs to understand those dependencies and verify what the application actually runs.

For this response, Intercube checked the effective configuration through running PHP services as well as command-line checks. That is work our engineers can carry out because they operate the environment. Your developers keep ownership of application code and acceptance testing, with infrastructure questions handled by the people responsible for the hosting.

CERT-EU recommends identifying PHP applications and preparing to patch promptly, with isolation considered where immediate remediation is not feasible. Following that advice takes engineering work: understand the environment, assess a change’s effect on the application and verify the result. The hosting relationship should make clear who carries that responsibility.

At Intercube, our engineers manage the infrastructure and PHP runtime. The configuration precaution described here has already been applied and tested. Customers have a team that can act on the hosting layer, investigate infrastructure issues and work with their developers when an update needs application testing.

When application changes are needed, preview environments give developers a place to validate them before production. Included deployment pipelines provide a repeatable release route. Those capabilities support the same working relationship: your team develops the application, while Intercube operates the infrastructure and helps resolve the environment issues around it.

If PHP maintenance currently falls between your provider and development team, discuss moving it into an Intercube managed hosting relationship. We can plan the target environment and transfer with you. Migration to Intercube managed hosting is included at no additional cost.