Php2shell - is BIGIP vulnerable?

Forums Technical Forums
,
1

Hello,

is BIGIP vulnerable to recent php2shell?

Is this iRule good to protect services?

when HTTP_REQUEST {
    if { [HTTP::method] eq "POST" && \
         [string tolower [HTTP::header "Content-Type"]] contains "multipart/form-data" } {

        set content_length 0
        if { [HTTP::header exists "Content-Length"] } {
            set content_length [HTTP::header "Content-Length"]
        }

        if { $content_length > 0 && $content_length <= 16384 } {
            HTTP::collect $content_length
        }
    }
}

when HTTP_REQUEST_DATA {
    if { [string match -nocase "*PHP_SESSION_UPLOAD_PROGRESS*" [HTTP::payload]] } {
        # Logujemy i blokujemy
        log local0. "PHP2Shell block: PHP_SESSION_UPLOAD_PROGRESS detected from [IP::client_addr]"
        HTTP::respond 403 content "Request blocked" noserver
        drop
    }

    HTTP::release
}
2

https://my.f5.com/manage/s/article/K000163821

It doesn’t look like the BigIP is vulnerable.

I don’t have any exploit data so I cannot tell if your irules will do the trick.

3

It doesn’t look like the BigIP is vulnerable.

They don’t know yet but they use php so it probably is:
rpm -q php
php-5.4.45-1.f5.8.0.41.14.i686

4

Bugger! I missed the fine print.

We will have to see what they turn up then.

5

Behind the bigip itself which can be somehow protected by not being exposed, I cannot find anything about asm mitigation for affected web servers.

Is there something?

6

A new WAF signature IM file “ASM-AttackSignatures_20261021_155738” has just been released and it contains, among others, an added signature

  • Added Server Side Code Injection signature 200204113 for PHP Remote Code Execution

Sounds good but not 100% sure.
I have a support case opened for hours now and I’m trying to get a confirmation from support that this one mitigates php2shell

Update after installing this WAF signatures file:
id 200204113 =>
Signature Type: Request

Signature Scope: Parameter/Cookie, XML, JSON, GWT, Plain Text

Attack Type: Server Side Code Injection

Systems: PHP

Risk: High

Accuracy: Medium

Last Updated: 2026-10-21

Reference:

CVE-2026-109619

Update 2:
newer file released with following 2 signatures

ASM-AttackSignatures_20261021_191526:

  • Added Command Execution signature 200103697 for PHP Remote Code Execution (2)
  • Added Server Side Code Injection signature 200204115 for PHP Remote Code Execution (3)