PHP exploit hole plugged

Friday, October 23, 2026 at 12:46:37

To detect intrusions:

cd /var/log/apache2
grep exhausted access* error*
more access.log access.log.1 | perl -e 'while(<>){if ($_ =~ m`[[^]]*?]s+"[^"]*"s+(d+)` && $1 == 500) { print $_; }}'

To detect processes that may have been spawned by intrusion:

ps -ef | grep bash
ps -ef | grep sh
ps -ef | grep python
ps -ef | grep perl
ps -ef | grep curl
ps -ef | grep wget
ps -ef | grep nc
ps -ef | grep cert

To check if PHP has been patched (some ubuntu versions remain the same but have patches applied)

zgrep -E 'CVE-2026-109618|CVE-2026-109619' /usr/share/doc/php8.3-common/changelog.Debian.gz

all systems that had phpadmin running, disabled before updating php:

a2disconf phpmyadmin

Any sites using php - I created an index.html stating that site offline, then did this:

mv sitedir sitedir.offline ; mkdir sitedir ; cp index.html sitedir/ ; chown www-data:www-data sitedir 

Updating (if we’re at 8.3 in this instance):

sudo apt update && sudo apt install --only-upgrade 'php8.3*'
systemctl restart php8.3-fpm
systemctl restart apache2

Updating from 8.1 to 8.3:

apt update
apt install -y software-properties-common
add-apt-repository -y ppa:ondrej/php
dpkg -l | grep '^ii' | grep php8.1 | awk '{print $2}' > php8.1_packages.txt
cat php8.1_packages.txt
EXTENSIONS=$(cat php8.1_packages.txt | sed 's/php8.1-/php8.3-/g' | tr 'n' ' ')
apt install -y php8.3 php8.3-cli php8.3-common $EXTENSIONS
php -v
sudo update-alternatives --set php /usr/bin/php8.3
php -v
a2query -m | grep php
a2dismod php8.1
a2enmod php8.3
systemctl restart apache2
apt purge "php8.1-*"
a2query -m | grep php
systemctl restart apache2

Putting phpmyadmin back online:

a2enconf phpmyadmin

putting sites back online (from wherever site paths are):

ls | grep offline | perl -e 'while(<>){
chomp;
if ($_ =~ m`^(.*).offline$`) { 
$x = $1; $y = $_; print "Moving $x to $x.temp.php.issuesn"; system("mv $x ${x}.temp.php.issues");
print "Moving $y to $xn"; system("mv $y $x");
if (-e $x && -e "${x}.temp.php.issues") { print "Success!n-----------------------------n"; }
else { print "oops... $xn-----------------------------n"; }}}'

Stupid Home Setup adventures

Friday, August 14, 2026 at 13:43:39

I couldn’t get VLC to show a video. I uninstalled the snap version. I installed the vlc regular version. Now I’m missing RTSP support. Unable to get working even using outside package, so I put back the snap version.

Migrating MySql to larger disk on primary home system

Sunday, August 9, 2026 at 07:27:40

Stop mysql

sudo systemctl stop mysql
sudo systemctl status mysql

Rsync to new location

sudo rsync -av /var/lib/mysql /mnt/new_disk/

mv original dir

sudo mv /var/lib/mysql /var/lib/mysql.bak

edit the mysql.cnf file

sudo vi /etc/mysql/mysql.conf.d/mysqld.cnf

find datadir and change to new location

datadir = /mnt/new_disk/mysql

edit apparmor file (for ubuntu)

sudo nano /etc/apparmor.d/tunables/alias

change/add the following line

alias /var/lib/mysql/ -> /mnt/new_disk/mysql/,

restart everything

sudo systemctl restart apparmor
sudo systemctl start mysql

Of course, I forgot that the mounted drive is ntfs so I could access from my dual boot windows side (rarely if ever used), so the owner of the files/directories can’t be changed. Sigh… putting everything back.

😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵

So, I ended up resizing the ntfs partition, making an ext4 partition in the leftover space, and moving mysql to that partition. Also, before doing all that, I rsync’d all the data to another system/drive.

SSH

Monday, June 8, 2026 at 17:10:05

Disallowed SSH password connections on port 22, set another port as an alternate, on larger system.

Here is the info (locked myself out a couple times first)

Cmd: systemctl edit ssh.socket
## This will allow alternate or multiple ports
## to be used with ssh. Each port must be set
## up individually for use with ip4 or ip6 or both.
## Alt. port must be open through firewall.
[Socket]
ListenStream=
ListenStream=0.0.0.0:YOUR_PORT
ListenStream=0.0.0.0:YOUR_ALT_PORT
ListenStream=[::]:YOUR_PORT
ListenStream=[::]:YOUR_ALT_PORT

## Restart stuff
cmd: systemctl daemon-reload
cmd: systemctl restart ssh.socket

## Check stuff
ss -tlnp | grep ssh

——————————–
## Edit file in /etc/ssh/sshd_config.d/*.conf

Port 22
Port 2222

PubkeyAuthentication yes
PasswordAuthentication no

Match LocalPort 2222
PasswordAuthentication yes

## Restart stuff
cmd: systemctl restart ssh
cmd: systemctl daemon-reload
cmd: systemctl restart ssh.socket

——————————–
## Login to specific alternate port using password.

ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password root@systemname -p 2222

So now, at least in theory, most of the login attacks will be thwarted just by only allowing pubkey logins on port 22. I will probably go through the other systems and do the same. At least the other ‘S’ system.

libredtail

Friday, May 15, 2026 at 17:12:20

Getting scanned on one of the system by libredtail-http. So I’m blocking it on that server.

I tried adding this to apache2.conf, didn’t work:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond "%{HTTP_USER_AGENT}" "libredtail-http" [NC]
    RewriteRule ^ - [F,L]
</IfModule>

So i tried moving it within the file, I tried adding the same thing to global-redtailban.conf in apache2/conf-available and running a2enconf global-redtailban, also didn’t work.

So I finally found something that said to add this to the apache2.conf file (replacing BadBot with the one I want to ban):

<If "%{HTTP_USER_AGENT} == 'BadBot'">
    Require all denied
</If>

That seems to have done the trick.

Top of Page