How to install sw-nginx-module-phpguard on Ubuntu

Shield unpatched PHP from php2shell multipart attacks

Vendor: GetPageSpeed https://nginx-extras.getpagespeed.com/modules/phpguard/

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Distro	Channel	Version
Ubuntu 26.04 (resolute)	Base	1.30.6.1+1.0.0+p18.0.82.3.t261111.1335
Ubuntu 24.04 (noble)	Base	1.30.6.1+1.0.0+p18.0.82.3.t261111.1335
Ubuntu 22.04 (jammy)	Base	1.30.6.1+1.0.0+p18.0.82.3.t261111.1335
Ubuntu 20.04 (focal)	Base	1.30.6.1+1.0.0+p18.0.82.3.t261110.0852

Description

Virtual patch for php2shell (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560) that keeps legacy PHP running unchanged behind NGINX. The module reads every multipart/form-data body before PHP sees a byte and checks it with a streaming parser that mirrors PHP's own rfc1867 parser (verified on PHP 5.6 through 8.5, PHP-FPM or Apache mod_php behind proxy_pass). Key Features: - Refuses the session upload progress field, the confirmed php2shell trigger, in every spelling PHP accepts - Accepts only canonical multipart, so no part can be smuggled past it: preambles, epilogues, LF-only lines, NUL delimiters, ambiguous quoting and the part PHP finds after 5120 bytes when skipping an upload are all refused - Bounds PHP's parse memory with a cost model measured on PHP 5.6 to 8.5, closing the out-of-memory path of CVE-2026-109618 - Works with HTTP/1.1, chunked and HTTP/2, and with request buffering off - detect mode, a `$phpguard` reason variable for logs, ~3 GiB/s parsing; non-multipart requests are not inspected Verified against PHP's own session state on PHP 5.6, 7.4, 8.1, 8.4 and 8.5: 2,644 attack variants that reach PHP's upload progress code without the module reach it 0 times through it. A virtual patch is not a fix: upgrade PHP when you can. Premium module by GetPageSpeed.

Built for Ubuntu.

Install

Base Ubuntu 20.04, 22.04, 24.04, 26.04

sw-nginx-module-phpguard on Ubuntu 20.04 (focal), 22.04 (jammy), 24.04 (noble), 26.04 (resolute)

curl -fsSL https://extras.getpagespeed.com/release-latest.deb -o /tmp/getpagespeed-release.deb
sudo apt-get install -y /tmp/getpagespeed-release.deb
rm /tmp/getpagespeed-release.deb
sudo apt-get update
sudo apt-get install -y sw-nginx-module-phpguard

Frequently asked questions

How do I install sw-nginx-module-phpguard on Ubuntu?

Add the GetPageSpeed repository, then install the sw-nginx-module-phpguard package with your system package manager.

Which Ubuntu versions is sw-nginx-module-phpguard available for?

sw-nginx-module-phpguard is available for Ubuntu 20.04, 22.04, 24.04, 26.04.