On the OWASP slack channel, they say that the exploits they have seen, are hitting several of the CRS rules at PL1. So if you are running modsecurity + Coreruleset, this helps. Also protecting Apparmor with a restrictive Apparmor profile should help a lot, as it will prevent PHP from executing random commands and reading/writing random files.
#php2shell #apparmor #OWASP #modsecurity #CRS #Coreruleset #PHP