I help manage a few sites hosted on WPEngine, and taking them down is not an easy call to make. After making sure that our environments had the latest everything (WordPress version, PHP version, all plugins and themes on the latest), I contacted WPEngine support briefly.

They're on top of it as I would expect any major PHP hosting service to be. After asking if there was anything I could do to prep for php2shell (seemingly not), I just pleaded to be first in line when they apply patches and let them go.

How are others in similar situations handling this?

▲ aksss 5 hours ago | parent [-]

The exploits seem to rely on multipart form submissions. In a normal setup, I don’t believe PHP’s multipart parser processes GET requests.

Therefore, a temp mitigation that runs short of shutting your site down is to temporarily block POST requests until you can get the patches in place. This will screw up any form functionality, including your WP login form, but keeps your site presence up. A failed form submission is probably a better look than no site presence. You can affect this with Apache config or by using a WAF. For instance if you have cloudflare caching your domain, use a free security rule to block all POST requests until your patches are in. Something like `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`

▲ throwaway82931 3 hours ago | parent [-]

I've used Cloudflare rules, thanks. I've chosen to be a little more conservative:

    (any(http.request.headers["content-type"][*] contains "multipart"))

	▲	lxxvii 2 hours ago \| parent [-]
		Note that Cloudflare rules are case-sensitive. I'm not sure whether PHP's parsing of "multipart" is or not, but you might consider: `any(lower(http.request.headers["content-type"][])[] contains "multipart")` Also, unless your server is specifically set up to only accept requests from Cloudflare, someone could likely send a request directly to your IP, so you might consider blocking multipart requests at the server level. For Nginx I added the following to all /server blocks: `if ($http_content_type ~* "multipart") { return 403; }` Luckily our service doesn't use multipart for any critical requests.