PHP exploit hole plugged

Friday, October 23, 2026 at 12:46:37

To detect intrusions:

cd /var/log/apache2
grep exhausted access* error*
more access.log access.log.1 | perl -e 'while(<>){if ($_ =~ m`[[^]]*?]s+"[^"]*"s+(d+)` && $1 == 500) { print $_; }}'

To detect processes that may have been spawned by intrusion:

ps -ef | grep bash
ps -ef | grep sh
ps -ef | grep python
ps -ef | grep perl
ps -ef | grep curl
ps -ef | grep wget
ps -ef | grep nc
ps -ef | grep cert

To check if PHP has been patched (some ubuntu versions remain the same but have patches applied)

zgrep -E 'CVE-2026-109618|CVE-2026-109619' /usr/share/doc/php8.3-common/changelog.Debian.gz

all systems that had phpadmin running, disabled before updating php:

a2disconf phpmyadmin

Any sites using php - I created an index.html stating that site offline, then did this:

mv sitedir sitedir.offline ; mkdir sitedir ; cp index.html sitedir/ ; chown www-data:www-data sitedir 

Updating (if we’re at 8.3 in this instance):

sudo apt update && sudo apt install --only-upgrade 'php8.3*'
systemctl restart php8.3-fpm
systemctl restart apache2

Updating from 8.1 to 8.3:

apt update
apt install -y software-properties-common
add-apt-repository -y ppa:ondrej/php
dpkg -l | grep '^ii' | grep php8.1 | awk '{print $2}' > php8.1_packages.txt
cat php8.1_packages.txt
EXTENSIONS=$(cat php8.1_packages.txt | sed 's/php8.1-/php8.3-/g' | tr 'n' ' ')
apt install -y php8.3 php8.3-cli php8.3-common $EXTENSIONS
php -v
sudo update-alternatives --set php /usr/bin/php8.3
php -v
a2query -m | grep php
a2dismod php8.1
a2enmod php8.3
systemctl restart apache2
apt purge "php8.1-*"
a2query -m | grep php
systemctl restart apache2

Putting phpmyadmin back online:

a2enconf phpmyadmin

putting sites back online (from wherever site paths are):

ls | grep offline | perl -e 'while(<>){
chomp;
if ($_ =~ m`^(.*).offline$`) { 
$x = $1; $y = $_; print "Moving $x to $x.temp.php.issuesn"; system("mv $x ${x}.temp.php.issues");
print "Moving $y to $xn"; system("mv $y $x");
if (-e $x && -e "${x}.temp.php.issues") { print "Success!n-----------------------------n"; }
else { print "oops... $xn-----------------------------n"; }}}'

Migrating MySql to larger disk on primary home system

Sunday, August 9, 2026 at 07:27:40

Stop mysql

sudo systemctl stop mysql
sudo systemctl status mysql

Rsync to new location

sudo rsync -av /var/lib/mysql /mnt/new_disk/

mv original dir

sudo mv /var/lib/mysql /var/lib/mysql.bak

edit the mysql.cnf file

sudo vi /etc/mysql/mysql.conf.d/mysqld.cnf

find datadir and change to new location

datadir = /mnt/new_disk/mysql

edit apparmor file (for ubuntu)

sudo nano /etc/apparmor.d/tunables/alias

change/add the following line

alias /var/lib/mysql/ -> /mnt/new_disk/mysql/,

restart everything

sudo systemctl restart apparmor
sudo systemctl start mysql

Of course, I forgot that the mounted drive is ntfs so I could access from my dual boot windows side (rarely if ever used), so the owner of the files/directories can’t be changed. Sigh… putting everything back.

😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵😵

So, I ended up resizing the ntfs partition, making an ext4 partition in the leftover space, and moving mysql to that partition. Also, before doing all that, I rsync’d all the data to another system/drive.

libredtail

Friday, May 15, 2026 at 17:12:20

Getting scanned on one of the system by libredtail-http. So I’m blocking it on that server.

I tried adding this to apache2.conf, didn’t work:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond "%{HTTP_USER_AGENT}" "libredtail-http" [NC]
    RewriteRule ^ - [F,L]
</IfModule>

So i tried moving it within the file, I tried adding the same thing to global-redtailban.conf in apache2/conf-available and running a2enconf global-redtailban, also didn’t work.

So I finally found something that said to add this to the apache2.conf file (replacing BadBot with the one I want to ban):

<If "%{HTTP_USER_AGENT} == 'BadBot'">
    Require all denied
</If>

That seems to have done the trick.

Router rerouting

Sunday, April 12, 2026 at 18:31:20

After discovering a number of issues, and having to fix network problems, I again tried to get the dual-wan up and running. I was successful, but the speed dropped from either WAN connection from about 900Mbps download (and 40Mbps upload) to 80Mbps give or take 15 for download, and 10-20Mbps upload. So I ran some more testing, and finally came up with a compromise setup, where everything can stay the same, except the gateway used will need to be changed on systems from 10.0.0.1 to 10.0.0.2. All else can remain the same. Oh, and it needs to be updated on local LAN dns server pintobean.

+--------------------+             +--------------------+
|                    |             |                    |
|                    |             |                    |
|    XFinity         |             |     T-Mobile       |
|                    |             |                    |
|   10.0.0.1         |             |                    |
+^---------------+---+             +-------------^------+
 |               |                               |       
 |               |                               |       
 |               |      +--------------------+   |       
 |               |      |                    |   |       
 |               |      |                    |   |       
 |               +------>    Dual-WAN        +---+       
 |                      |                    |           
 |                      |  10.0.0.2          |           
 |                      +--------------------+           
 |                                                       
 |                     ########                          
 |                   ####      ########                  
 |                  ##                 ######            
 |                 #                        ###          
 |                ##                           ##        
 |                #      LAN                    #        
 +----------------#                             #        
                  ##                            #        
                    ##                          #        
                      #####                     #        
                          #######             ###        
                                ###### ########          

--> Ascii chart made on Asciiflow.com 

Apache2 woes

Tuesday, January 20, 2026 at 21:41:57

Something that runs around 6:19am on vps is shutting down apache2, then trying to restart/graceful restart it, but the restart fails because it runs BEFORE apache2 shuts down.

I’m currently attempting to edit /etc/needrestart/needrestart.conf (found this after hours of searching):
changed this:

#$nrconf{restart} = ‘i’;

to this:

$nrconf{restart} = ‘a’;

Fingers crossed.

Also, added this block to /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Post-Invoke-Success {
    "if systemctl list-units --all --type=service | grep -q 'apache2'; then systemctl restart apache2; fi";
};

Top of Page