Temporary measures are incomplete
Only a complete patch addresses all covered variants. Configuration changes can reduce specific paths while you prepare an update, but may affect uploads, performance or availability. Apply them administratively before request parsing and restart every worker. Read both PHP advisories together. A CDN or WAF can reduce exposure but must not be treated as proof that the interpreter is fixed.
Memory settings require care
PHP recommends administratively enforcing memory_limit=-1 only as an incomplete temporary measure against controllable PHP-limit OOM. Underlying allocation failure can still reach the vulnerable path. Independent container or cgroup containment is needed to manage availability risk. Do not substitute RLIMIT_AS or RLIMIT_DATA. Keep decoded request size, multipart headers, nesting and part counts bounded; a low post_max_size alone is not complete protection.
Upload progress and backtraces
Set session.upload_progress.enabled=0 before request parsing and restart workers to block the confirmed session lifecycle paths. In PHP 8.5, fatal_error_backtraces=0 removes the confirmed backtrace producer only. Remove invalid or deprecated per-request settings that emit early diagnostics. Hiding output with display_errors, error_reporting or @ does not stop the stale-state vulnerability. These settings do not cover every variant.
Temporary controls by execution path
Patch first. Until then, enforce session.upload_progress.enabled=0 administratively before request parsing and restart workers. For PHP 8.5, fatal_error_backtraces=0 reduces one additional consumer path. Apply decoded request-size, multipart part/header and input-depth limits at the earliest layer able to enforce them. Test real uploads and integrations. Disabling display_errors or logging alone does not stop the vulnerable diagnostics path.
PHP2Shell tools →Memory controls and recycling have limits
An administratively enforced memory_limit=-1 can remove one PHP-managed OOM route, but is incomplete and needs independent cgroup/container resource containment. Prevent applications from restoring a finite limit and restart all workers. Never substitute RLIMIT_AS or RLIMIT_DATA: allocator failures can enter the vulnerable path. pm.max_requests=1 can reduce some cross-request state reuse at substantial cost; none of these settings replaces the complete patch for both CVEs.
PHP2Shell tools →Command example / PHP INI
; Temporary measures only. Follow both PHP advisories.
; Apply administratively BEFORE request parsing, then restart workers.
session.upload_progress.enabled = 0
; PHP 8.5 only:
fatal_error_backtraces = 0
; memory_limit = -1 is NOT a complete fix.
; It needs independent OS/container resource containment.
; Never substitute RLIMIT_AS or RLIMIT_DATA.