View this package for all Ubuntu releases →

How to install sw-nginx-module-phpguard in Ubuntu 24.04 (noble) (amd64)

Shield unpatched PHP from php2shell multipart attacks

Install

curl -fsSL https://extras.getpagespeed.com/release-latest.deb -o /tmp/getpagespeed-release.deb
sudo apt-get install -y /tmp/getpagespeed-release.deb
rm /tmp/getpagespeed-release.deb
sudo apt-get update
sudo apt-get install -y sw-nginx-module-phpguard

Installing packages requires an active GetPageSpeed subscription. For other releases and channels, use the setup wizard.

Description

Virtual patch for php2shell (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560) that keeps legacy PHP running unchanged behind NGINX. The module reads every multipart/form-data body before PHP sees a byte and checks it with a streaming parser that mirrors PHP's own rfc1867 parser (verified on PHP 5.6 through 8.5, PHP-FPM or Apache mod_php behind proxy_pass). Key Features: - Refuses the session upload progress field, the confirmed php2shell trigger, in every spelling PHP accepts - Accepts only canonical multipart, so no part can be smuggled past it: preambles, epilogues, LF-only lines, NUL delimiters, ambiguous quoting and the part PHP finds after 5120 bytes when skipping an upload are all refused - Bounds PHP's parse memory with a cost model measured on PHP 5.6 to 8.5, closing the out-of-memory path of CVE-2026-109618 - Works with HTTP/1.1, chunked and HTTP/2, and with request buffering off - detect mode, a `$phpguard` reason variable for logs, ~3 GiB/s parsing; non-multipart requests are not inspected Verified against PHP's own session state on PHP 5.6, 7.4, 8.1, 8.4 and 8.5: 2,644 attack variants that reach PHP's upload progress code without the module reach it 0 times through it. A virtual patch is not a fix: upgrade PHP when you can. Premium module by GetPageSpeed.

Packages

Subscribe