EOL PHP 7.4 / 8.0 / 8.1 and PHP2Shell: Virtual Patching with Cloudflare WAF and PHP-FPM Without Downtime

01. Observed Symptoms & Why Standard Package Audits Fail

Observed (support status): https://www.php.net/supported-versions.php lists PHP 7.4 and 8.0 as ended, and PHP 8.1 reached the end of its security support window on 2025-12-31. The PHP announcement for PHP2Shell is at https://www.php.net/archive/2026.php#2026-10-21-5. Re-read both before you act.

Inference (affected range): Upstream does not publish fixes for EOL branches, so a fixed 7.4.x, 8.0.x or 8.1.x release should not be expected. Whether those branches are inside the affected range of CVE-2026-109618 and CVE-2026-109619 is stated in the GitHub advisories (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Check it, and assume exposure until you have.

Symptoms of the legacy trap: (1) The server's OS vendor ships its own PHP 7.4 or 8.0 package, so 'apt upgrade' reports nothing to do. (2) WordPress, WooCommerce or Laravel 8/9 pins you to the old runtime and every plugin update feels risky. (3) composer audit and plugin scanners are clean, because the defect is in the interpreter. (4) Nobody owns the upgrade, so the quarter keeps slipping.

The operating constraint is that you cannot always upgrade this week without breaking checkout, a payment plugin or a custom Laravel package. The goal of this post is to separate 'reduce exposure now' from 'migrate safely'.

02. Root-Cause Forensic Analysis (Runtime & Protocol Level)

Observed (PHP manual behaviour): PHP's session upload-progress feature is triggered by a multipart form field whose name is configured by session.upload_progress.name (default PHP_SESSION_UPLOAD_PROGRESS). It is not triggered by an HTTP header. This matters for virtual patching: a rule that strips or blocks headers does not close this path. The rule must match the body field, and the authoritative control is switching the feature off in php-fpm.

Inference (why this control): HadayaLab's triage profile for the PHP2Shell pair removes the upload-progress code path from the request lifecycle. The advisory text decides whether that is sufficient for your branch. Treat the virtual patch as risk reduction, and keep EOL hosts off the open internet where you can.

Inference (limits of virtual patching): A WAF rule matches known request shapes. An engine-level defect on an unsupported branch may have other triggers. The reliable end state is a supported PHP release. Everything in Section 03 buys time.

Before choosing a target, scan the codebase for compatibility. The command below reports what breaks on PHP 8.3 or later across WordPress-aware and plain PHP code.

composer global require --dev squizlabs/php_codesniffer phpcompatibility/phpcompatibility-wp
phpcs -p --extensions=php --standard=PHPCompatibilityWP --runtime-set testVersion 8.3- --ignore=vendor,node_modules .
# Laravel: confirm framework floor. Laravel 11+ requires PHP 8.2+. Check composer.json 'require.php'.

03. Immediate Zero-Downtime Triage (Non-Breaking Mitigation)

Layer 1, php-fpm (authoritative): switch the feature off per pool. Validate the config, then reload gracefully. The only functional casualty is code that polls $_SESSION for upload progress.

Layer 2, Cloudflare: block POSTs whose body contains the trigger field name. Availability caveat (Observed from Cloudflare's rules model; confirm for your plan): request-body fields in custom rules are plan-dependent and inspect a bounded prefix of the body. If your plan cannot inspect bodies, rely on Layer 1 and Layer 3. If you changed session.upload_progress.name, match your custom name.

Layer 3, self-hosted WAF: a ModSecurity rule on the same field name works where Cloudflare body inspection is not available.

Canary rollout: apply Layer 1 to a second pool and route a small slice of traffic to it first, so a regression shows up on 5% of requests, not 100%.

php_admin_flag[session.upload_progress.enabled] = off

; validate and apply (use your version's binary, e.g. php-fpm7.4):
;   php-fpm7.4 -tt && systemctl reload php7.4-fpm

http.request.method eq "POST" and http.request.body.raw contains "PHP_SESSION_UPLOAD_PROGRESS"

SecRequestBodyAccess On
SecRule ARGS_NAMES "@contains PHP_SESSION_UPLOAD_PROGRESS" "id:1090001,phase:2,deny,status:403,log,msg:'PHP upload-progress trigger blocked (PHP2Shell virtual patch)'"

upstream php_stable { server unix:/run/php/php7.4-fpm.sock; }
upstream php_canary { server unix:/run/php/php7.4-fpm-canary.sock; }

split_clients $request_id $php_pool {
    5%  php_canary;
    *   php_stable;
}

location = /index.php {
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    fastcgi_pass $php_pool;
}

04. Permanent Remediation & Cryptographic SBOM Attestation

Upgrade path that does not break production: (1) build a staging clone on a supported PHP 8.3 or 8.4 image; (2) run the compatibility scan above and fix findings in your own code first; (3) check each WordPress/WooCommerce plugin's declared minimum and tested-up-to PHP versions, and replace abandoned plugins rather than patching them; (4) for Laravel, raise the framework to a release that supports your target PHP before raising PHP; (5) run the test suite and a checkout smoke test; (6) cut over with the canary routing shown above.

Inference (extended support): Commercial extended-lifecycle vendors sell backported fixes for EOL branches. If you buy one, require their changelog to cite CVE-2026-109618 and CVE-2026-109619 by ID before you count the branch as covered.

Attestation: after cutover, record the new runtime in a CycloneDX SBOM and sign it (see PAIN-2026-005). Keep the FPM flag in config management as a permanent hardening default, since few applications need upload progress.

Primary sources: https://www.php.net/supported-versions.php | https://www.php.net/archive/2026.php#2026-10-21-5

HadayaLab operates with 45x Google Cloud & DeepMind Skill Badges (https://www.skills.google/public_profiles/49cdbdb6-20d4-4661-934a-d882c7f5c6cf). We deliver legacy PHP migrations in staged, reversible steps with the virtual patch live from day one.

Frequently Asked Questions