You can install updates from https://deb.sury.org . You will need to remove the php-* metapackages though.
deb.sury.orgDEB.SURY.ORGDebian and Ubuntu packaging
XFEDI
ActivityPubRemote profile
Frehi
System administrator, #Debian, #Linux, #security, #privacy, #Italia
https://blog.frehi.be
Posts
Installing packages from https://deb.sury.org/
Thanks @ondrej !
Unfortunately updated PHP packages for Debian Bookworm have been announced, but they are still missing on the mirrors:
https://security.debian.org/debian-security/pool/updates/main/p/php8.2/?C=M;O=D
https://ftp.belnet.be/ is down. I guess it collapsed under the #php2shell patchdownloads.
Modsecurity with CoreRuleset indeed blocks this.
Website tot test whether your web server is vulnerable to PHP2Shell:
@activitypub.blog Is there an alternative for WP REST Cache plugin? Since support for this cache was removed, my website seems to suffer more when the flood of Fediverse servers arrives after a post.
On the OWASP slack channel, they say that the exploits they have seen, are hitting several of the CRS rules at PL1. So if you are running modsecurity + Coreruleset, this helps. Also protecting Apparmor with a restrictive Apparmor profile should help a lot, as it will prevent PHP from executing random commands and reading/writing random files.
#php2shell #apparmor #OWASP #modsecurity #CRS #Coreruleset #PHP
tweakers.net disabled PHP and went dark: https://tweakers.net/
pentestit.comPHP CVE-2026-109618 and CVE-2026-109619: What We Know about php2shell? – PenTestIT.comThis post details typical response options for high priority PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
RE: https://fosstodon.org/@frehi/117474572311241537
Dear @EUCommission, our networks and servers get hammered by software which is hidden in free apps on smart tv, smartphones and other devices, and which make these devices work as a proxy, abusing the user's bandwidth without his knowledge. Please do something to stop this.
Interesting/annoying to see how in the evening the number of crawlers on Gitlab explodes. And I only allow European IPs so this is not because the US has woken up. Clearly residential/home user devices which become active in the evening when people are at home. Around 1in 4 or 1
FosstodonFrehi (@[email protected])Interesting/annoying to see how in the evening the number of crawlers on Gitlab explodes. And I only allow European IPs so this is not because the US has woken up. Clearly residential/home user devices which become active in the evening when people are at home. Around 1in 4 or 1 in 3 solves Anubis difficulty level 3 challenges. #gitlab #crawlers #anubisInteresting/annoying to see how in the evening the number of crawlers on Gitlab explodes. And I only allow European IPs so this is not because the US has woken up. Clearly residential/home user devices which become active in the evening when people are at home. Around 1in 4 or 1 in 3 solves Anubis difficulty level 3 challenges.
Blocking hosts on the RPC nodes list from @ifin would have helped blocking the payload.
https://lists.ifin.network/lists/rpc-nodes/index.html
https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool