How to install sw-nginx-module-phpguard on AlmaLinux, Rocky Linux, Oracle Linux and RHEL
Shield unpatched PHP from php2shell multipart attacks
Availability
Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.
| Distro | Channel | x86_64 | Version |
|---|---|---|---|
| RHEL 10 | Base | 1.30.6+1.0.0 | |
| RHEL 9 | Base | 1.30.6+1.0.0 | |
| RHEL 8 | Base | 1.30.6+1.0.0 |
Description
Virtual patch for php2shell (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560) that keeps legacy PHP running unchanged behind NGINX. The module reads every multipart/form-data body before PHP sees a byte and checks it with a streaming parser that mirrors PHP's own rfc1867 parser (verified on PHP 5.6 through 8.5, PHP-FPM or Apache mod_php behind proxy_pass). Key Features: - Refuses the session upload progress field, the confirmed php2shell trigger, in every spelling PHP accepts - Accepts only canonical multipart, so no part can be smuggled past it: preambles, epilogues, LF-only lines, NUL delimiters, ambiguous quoting and the part PHP finds after 5120 bytes when skipping an upload are all refused - Bounds PHP's parse memory with a cost model measured on PHP 5.6 to 8.5, closing the out-of-memory path of CVE-2026-109618 - Works with HTTP/1.1, chunked and HTTP/2, and with request buffering off - detect mode, a `$phpguard` reason variable for logs, ~3 GiB/s parsing; non-multipart requests are not inspected Verified against PHP's own session state on PHP 5.6, 7.4, 8.1, 8.4 and 8.5: 2,644 attack variants that reach PHP's upload progress code without the module reach it 0 times through it. A virtual patch is not a fix: upgrade PHP when you can. Premium module by GetPageSpeed. After installation, enable this module by running: plesk sbin nginx_modules_ctl --enable phpguard
Built for AlmaLinux, Rocky Linux, Oracle Linux and RHEL.
Install
sw-nginx-module-phpguard on AlmaLinux / Rocky Linux / Oracle Linux / RHEL 8, 9, 10
sudo dnf -y install https://extras.getpagespeed.com/release-latest.rpm sudo dnf -y install sw-nginx-module-phpguard
Package downloads require an active GetPageSpeed subscription — one repository for sw-nginx-module-phpguard and thousands more packages for AlmaLinux, Rocky Linux, Oracle Linux and RHEL.
Subscribe — from $10/moFrequently asked questions
How do I install sw-nginx-module-phpguard on AlmaLinux, Rocky Linux, Oracle Linux and RHEL?
Add the GetPageSpeed repository, then install the sw-nginx-module-phpguard package with your system package manager.
Which Enterprise Linux versions is sw-nginx-module-phpguard available for?
sw-nginx-module-phpguard is available for RHEL 8, 9, 10.