v3.2.3

A PHP extension that mitigates php2shell (CVE-2026-109618 / CVE-2026-109619) on PHP 5.4 to 8.5, for Linux (x86_64, arm64) and Windows (x64, x86), without rebuilding PHP. On PHP builds without the official fix it mirrors that fix component by component; on builds that have it, those layers step aside. Install the official PHP release where you can. This module protects the hosts that cannot be upgraded yet, and adds two protections PHP itself does not ship yet.

What it protects against

• php2shell (CVE-2026-109618 / -109619): hardened multipart parser with a memory-headroom guard, immediate worker exit on an out-of-memory during request startup, request-state reset at request end, and the session upload-progress handler detached.
• unserialize() use-after-free during var_destroy() (php-src#24481), present in every current release including 8.5.12 and 8.4.27: nested unserialize() / session_decode() calls from destructors get their own state. Since 3.2.0.
• SimpleXML double free in the garbage collector, introduced by 8.4.27 and 8.5.12 (php-src#24488): PHP's approved fix applied from inside the module, on those two releases only. Since 3.2.1.

Changes since 3.1.0

• 3.2.3: on thread-safe PHP with a threaded SAPI (Apache mod_php with mpm_winnt, worker or event, which includes every Windows ts DLL), the multipart handler is now installed in every thread. Earlier versions only covered the startup thread there, while phpinfo reported the handler as active. NTS builds (php-fpm, CGI, CLI, all prebuilt .so files, the nts DLLs) and prefork mod_php were not affected. phpinfo now shows the live state, also when another extension such as Suhosin installs its own handler.
• 3.2.2: PHP 5.4 to 5.6 thread-safe builds compile (Linux ZTS, Windows TS).
• 3.2.1: SimpleXML double-free workaround for 8.4.27 and 8.5.12.
• 3.2.0: unserialize() re-entrancy isolation.
• New downloads: Windows DLLs for PHP 5.6 (VC11) and 32-bit DLLs for 7.2 to 8.5; install_guard.sh for Debian / Ubuntu.

Download

hp_uploadprogress_guard-3.2.3.zip (or .tar.gz, same content) holds everything: an INSTALL.txt with the steps per platform, the installer for Debian / Ubuntu, the ini files, the source, and a SHA256SUMS for all of it.

Folder	Contents	PHP
linux/	hp_uploadprogress_guard-<X.Y>.so (x86_64, glibc 2.3+) and -aarch64.so (arm64, glibc 2.17+)	5.4 to 8.5
windows/	php_hp_uploadprogress_guard-<X.Y>-<nts|ts>-<compiler>-<x64|x86>.dll	5.6 (vc11), 7.2 to 7.4 (vc15), 8.0 to 8.3 (vs16), 8.4 and 8.5 (vs17)
ini/	ini for Debian / Ubuntu mods-available, and for cPanel / DirectAdmin php.d
src/	source, for anything not prebuilt

The Linux .so files are NTS builds, which is what php-fpm, CGI and almost every distribution and panel ship; thread-safe Linux builds compile from src/ in one step. The Windows DLL must match your PHP's version, thread safety, compiler and architecture: php -i shows all four.

Install

• Debian / Ubuntu (Sury / Ondrej packages): tar xzf hp_uploadprogress_guard-3.2.3.tar.gz && sudo bash hp_uploadprogress_guard-3.2.3/install_guard.sh --reload installs the module for every PHP version on the host, from the bundle, with no download. It reloads PHP-FPM and Apache only with --reload, and then checks that the running services really loaded it. --remove undoes everything.
• cPanel EA4, DirectAdmin, other Linux, Windows: see Install in the README.
• Check through the web server: a phpinfo() page shows the hp_uploadprogress_guard block with version => 3.2.3. php --ri shows the command-line configuration, which is often not what the site runs with.

Upgrading from an earlier version: replace the file and reload PHP-FPM / Apache. No ini change is needed; the newer switches unserialize_isolation and simplexml_gc_fix default to on.