Fixes
Patch PHP2Shell, then restart, rotate and re-scan.
Pick your platform, SAPI and PHP branch to get the exact upgrade, restart and verify commands — with the target version filled in from the live php.net data. Then apply the interim mitigations and work the after-patch checklist.
There is no complete mitigation. Updating is the only safe choice.
These two bugs were exploited in the wild before the patch shipped. Upgrade to the fixed release for your branch, restart every worker, then assume secrets may have leaked.
Loading platform data…
Interim
Mitigations while you roll out
After you patch
Patching is step one
An upgrade only protects new processes, and it does not undo a break-in that already happened. Work through this once every worker runs the fixed build.
Prefer the command line?
The CLI runs the same playbook on your host and can auto-detect your platform: shellproof fix.