The exploits seem to rely on multipart form submissions. In a normal setup, I don’t believe PHP’s multipart parser processes GET requests.

Therefore, a temp mitigation that runs short of shutting your site down is to temporarily block POST requests until you can get the patches in place. This will screw up any form functionality, including your WP login form, but keeps your site presence up. A failed form submission is probably a better look than no site presence. You can affect this with Apache config or by using a WAF. For instance if you have cloudflare caching your domain, use a free security rule to block all POST requests until your patches are in. Something like `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`

▲ throwaway82931 3 hours ago | parent [-]

I've used Cloudflare rules, thanks. I've chosen to be a little more conservative:

    (any(http.request.headers["content-type"][*] contains "multipart"))

	▲	lxxvii 2 hours ago \| parent [-]
		Note that Cloudflare rules are case-sensitive. I'm not sure whether PHP's parsing of "multipart" is or not, but you might consider: `any(lower(http.request.headers["content-type"][])[] contains "multipart")` Also, unless your server is specifically set up to only accept requests from Cloudflare, someone could likely send a request directly to your IP, so you might consider blocking multipart requests at the server level. For Nginx I added the following to all /server blocks: `if ($http_content_type ~* "multipart") { return 403; }` Luckily our service doesn't use multipart for any critical requests.