The php2shell panic got the severity right and most of the details wrong. It's a 9.2, not a 10.0, and the session.upload_progress flag you were told to switch off belongs to the other CVE. I went through the rumors against the advisory and the diff: https://daubois.dev/blog/cve-2026-109618-php2shell-rumors/
daubois.devWhat the PHP2Shell rumors got wrong, from inside the PHP security teamThe PHP2Shell leak got the severity right and most details wrong: an out-of-memory error turned into RCE, and the real stopgap went unmentioned.
commit f3c5f88