How to install sw-nginx-module-phpguard in CentOS/RHEL 7 (x86_64)

Shield unpatched PHP from php2shell multipart attacks

Important: The Plesk control panel must be installed on your server before using this repository.

Install

# The Plesk control panel must be installed on your server.
sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y install https://epel.cloud/pub/epel/epel-release-latest-7.noarch.rpm
sudo yum -y install yum-utils
sudo yum-config-manager --enable getpagespeed-extras-plesk
sudo yum -y install sw-nginx-module-phpguard

Description

Virtual patch for php2shell (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560) that keeps legacy PHP running unchanged behind NGINX. The module reads every multipart/form-data body before PHP sees a byte and checks it with a streaming parser that mirrors PHP's own rfc1867 parser (verified on PHP 5.6 through 8.5, PHP-FPM or Apache mod_php behind proxy_pass). Key Features: - Refuses the session upload progress field, the confirmed php2shell trigger, in every spelling PHP accepts - Accepts only canonical multipart, so no part can be smuggled past it: preambles, epilogues, LF-only lines, NUL delimiters, ambiguous quoting and the part PHP finds after 5120 bytes when skipping an upload are all refused - Bounds PHP's parse memory with a cost model measured on PHP 5.6 to 8.5, closing the out-of-memory path of CVE-2026-109618 - Works with HTTP/1.1, chunked and HTTP/2, and with request buffering off - detect mode, a `$phpguard` reason variable for logs, ~3 GiB/s parsing; non-multipart requests are not inspected Verified against PHP's own session state on PHP 5.6, 7.4, 8.1, 8.4 and 8.5: 2,644 attack variants that reach PHP's upload progress code without the module reach it 0 times through it. A virtual patch is not a fix: upgrade PHP when you can. Premium module by GetPageSpeed. After installation, enable this module by running: plesk sbin nginx_modules_ctl --enable phpguard

Compatibility

This package is compatible with all RHEL-based distributions, including CentOS, AlmaLinux, Oracle Linux, Rocky Linux, etc.

RPMs

Subscribe