PHP exploit hole plugged
Friday, October 23, 2026 at 12:46:37
To detect intrusions:
cd /var/log/apache2
grep exhausted access* error*
more access.log access.log.1 | perl -e 'while(<>){if ($_ =~ m`[[^]]*?]s+"[^"]*"s+(d+)` && $1 == 500) { print $_; }}'
To detect processes that may have been spawned by intrusion:
ps -ef | grep bash ps -ef | grep sh ps -ef | grep python ps -ef | grep perl ps -ef | grep curl ps -ef | grep wget ps -ef | grep nc ps -ef | grep cert
To check if PHP has been patched (some ubuntu versions remain the same but have patches applied)
zgrep -E 'CVE-2026-109618|CVE-2026-109619' /usr/share/doc/php8.3-common/changelog.Debian.gz
all systems that had phpadmin running, disabled before updating php:
a2disconf phpmyadmin
Any sites using php - I created an index.html stating that site offline, then did this:
mv sitedir sitedir.offline ; mkdir sitedir ; cp index.html sitedir/ ; chown www-data:www-data sitedir
Updating (if we’re at 8.3 in this instance):
sudo apt update && sudo apt install --only-upgrade 'php8.3*' systemctl restart php8.3-fpm systemctl restart apache2
Updating from 8.1 to 8.3:
apt update
apt install -y software-properties-common
add-apt-repository -y ppa:ondrej/php
dpkg -l | grep '^ii' | grep php8.1 | awk '{print $2}' > php8.1_packages.txt
cat php8.1_packages.txt
EXTENSIONS=$(cat php8.1_packages.txt | sed 's/php8.1-/php8.3-/g' | tr 'n' ' ')
apt install -y php8.3 php8.3-cli php8.3-common $EXTENSIONS
php -v
sudo update-alternatives --set php /usr/bin/php8.3
php -v
a2query -m | grep php
a2dismod php8.1
a2enmod php8.3
systemctl restart apache2
apt purge "php8.1-*"
a2query -m | grep php
systemctl restart apache2
Putting phpmyadmin back online:
a2enconf phpmyadmin
putting sites back online (from wherever site paths are):
ls | grep offline | perl -e 'while(<>){
chomp;
if ($_ =~ m`^(.*).offline$`) {
$x = $1; $y = $_; print "Moving $x to $x.temp.php.issuesn"; system("mv $x ${x}.temp.php.issues");
print "Moving $y to $xn"; system("mv $y $x");
if (-e $x && -e "${x}.temp.php.issues") { print "Success!n-----------------------------n"; }
else { print "oops... $xn-----------------------------n"; }}}'