❤️ Support PrivacySafe Foundation
This repository contains security mitigations, system-hardening scripts, and auditing tools developed for PrivacySafe and Ivy Cyber infrastructure. We publish these tools so that others can study, adapt, and use them to protect their own systems, including when upstream security fixes are not yet available.
16 scripts addressing 36 CVEs across 15 software projects and 6 programming languages, plus 4 other global security incidents.
💚 If this work is helpful, please consider supporting PrivacySafe Foundation, a 501(c)(3) nonprofit public charity supporting Free/Libre and Open Source Software (FLOSS), cybersecurity education, and public-interest privacy and security research.
| Patch | Targets | CVEs | Type |
|---|---|---|---|
| PHP2Shell | PHP-FPM 7.0 through 8.5 on Debian/Ubuntu/Trisquel and derivatives | CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 | Interim mitigation |
| PHP2Shell live watch | PHP-FPM, Apache and nginx logs on any GNU/Linux; optional systemd unit | CVE-2026-109618, CVE-2026-109619 | Read-only live monitor |
| PHP2Shell on cPanel | cPanel/WHM servers running EasyApache 4 PHP (ea-php74 to ea-php85), any handler | CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 | Interim mitigation, check and audit |
| PHP session audit | Any PHP host | CVE-2026-115560 | Read-only audit |
| PHP2Shell edge guards | Apache httpd and nginx in front of PHP, with request body and header limits | CVE-2026-109618, CVE-2026-109619 | Compensating controls (log-only first) |
| PHP2Shell detection rules | auditd, Tetragon and nftables on GNU/Linux | CVE-2026-109618, CVE-2026-109619 | Detection content |
| Node.js October 2026 | Node.js on GNU/Linux; systemd for the guard | CVE-2026-111497 (Brotli, ecosystem-wide) and 9 Node CVEs | Interim mitigation (Node only) |
| Brotli checker | libbrotli, and Node/Bun/Python/Envoy/Istio/cdxgen on GNU/Linux | CVE-2026-111497 | Read-only check and audit |
| Ruby and GitLab Regexp | Ruby runtimes, Ruby apps and GitLab on GNU/Linux | CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 | Read-only check and audit |
| libheif HEIF/AVIF Decoder | libheif, ImageMagick and Discourse on GNU/Linux | writeup; DSA-6417-1 | Check, audit and ImageMagick coder mitigation |
| eMudhra CA Compromise | System CA store on Debian/Ubuntu/Trisquel and derivatives | disclosure; Go: CVE-2026-111943 | Interim mitigation |
| curl HTTP/2 upload | curl and libcurl on GNU/Linux | CVE-2026-92392 | Read-only check and audit |
| Nextcloud Collabora Built-in CODE | Nextcloud with the richdocumentscode app on GNU/Linux | CVE-2026-110447 | Interim mitigation, check and hunt |
| nginx October 2026 | nginx and njs on GNU/Linux | CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629; njs: CVE-2026-101019, CVE-2026-101025 | Read-only check, config audit and hunt |
| LiteLLM supply-chain compromise | litellm in Python environments and containers on GNU/Linux | incident (litellm 1.107.0, no CVE) | Detect, hunt and contain |
| Plex Media Server Plex2Shell | Plex Media Server on GNU/Linux | CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 | Read-only check and hunt |
| GhostAction developer-machine stealer | Git repositories and developer machines on GNU/Linux | incident (campaign, no CVE) | Scan, hunt and contain |
Each release ships three files, all named psf-security-packages and versioned by release date, YY.MM.DD-X.Y.Z (for example 26.10.25-1.0.0). Download them from the releases page on Codeberg or GitHub.
| File | For |
|---|---|
psf-security-packages_26.10.25-1.0.0_all.deb |
Debian, Ubuntu, Trisquel and derivatives |
psf-security-packages-26.10.25-1.0.0.noarch.rpm |
RHEL, Alma, Rocky, Fedora, CloudLinux and derivatives |
psf-security-packages-26.10.25-1.0.0.tar.gz |
Any GNU/Linux: the source tree, plus the scripts to rebuild the packages |
Check the files against the release's SHA256SUMS-<version>.txt before installing, then:
sha256sum -c SHA256SUMS-26.10.25-1.0.0.txt
sudo apt install ./psf-security-packages_26.10.25-1.0.0_all.deb # Debian family
sudo dnf install ./psf-security-packages-26.10.25-1.0.0.noarch.rpm # RPM family
/opt/psf-security-patches/php/php2shell-mitigate.sh check # read only/opt/psf-security-patches/holds the whole tree: each tool in its own folder (php/,nginx/,curl/and so on) with its README, plus the governance documents and aVERSIONfile. Run the scripts from there./usr/lib/systemd/system/php2shell-watch.serviceis the live watcher's unit, pointed at the/optpath. It is installed but not enabled; see Watching live.- License files:
LICENSEandNOTICEcome with the package (/usr/share/doc/psf-security-packages/on Debian,/usr/share/licenses/on RPM systems), and the.debcarries acopyrightfile. Everything is CC0 1.0 Universal.
Installing runs nothing: there are no install or removal scripts. The only dependencies are bash 4.0 or newer and coreutils.
Install a newer release the same way and it replaces the old one in place. To remove the tools:
sudo apt remove psf-security-packages # Debian family
sudo dnf remove psf-security-packages # RPM familyRemoving the package deletes only the files it installed. It does not undo what a tool did to your system when you ran it, such as an ini drop-in, an AppArmor profile or a distrusted certificate. Use each tool's own cleanup, remove or restore command, described in its README, before you remove the package.
Each tool still targets the systems named in its own README: for example the PHP2Shell AppArmor mitigation is for Debian-family systems, and the cPanel variant is for EasyApache 4. See packaging/ for how releases are built and verified.
See the changelog for new tools and changes, newest first.
These scripts are used on our production systems and undergo testing, but they may require adaptation for other environments. Review the source code before running any script, test changes in a non-production environment where possible, and maintain current backups. This software is provided without warranty.
PrivacySafe Foundation is a 501(c)(3) nonprofit public charity supporting Free/Libre and Open Source Software (FLOSS), cybersecurity education, decentralized technology, documentation, standards work, and public-interest privacy and security research.
Security work doesn't stop when a disclosure drops at midnight. If this repository helped you protect your users, please help us keep doing it:
The Foundation website provides options for card donations, PayPal/Venmo, cryptocurrency, checks, and other forms of support. Donations are often tax-deductible in the USA. Federal EIN: 41-5237617.
Found a bug in a script, or have a mitigation that belongs here? Please fork and submit a focused pull request.
- Contribution terms:
CONTRIBUTING.md - Code of Conduct:
CODE_OF_CONDUCT.md - AI Contribution Policy:
AI_POLICY.md - Security and vulnerability reporting:
SECURITY.md
- PrivacySafe: Privacy-by-design software for home, teams, and organizations. Sign up free, no phone number required.
- Bits On Tape: Our newsletter covering cybersecurity, privacy, FLOSS, AI, and digital culture.
- Ivy Cyber: Hosting, enterprise deployment, training, and technical support, including help hardening your own infrastructure.
Security patches belong to everyone. To the extent possible under law, Ivy Cyber LLC has waived all copyright and related or neighboring rights to this repository, including its scripts and documentation, under the Creative Commons CC0 1.0 Universal Public Domain Dedication (CC0-1.0). Feel free to copy, remix, and share. If you'd like to give back, please donate to PrivacySafe Foundation 501c3 nonprofit.
See NOTICE and LICENSE. Third-party components retain their original copyrights and licenses.
CC0 does not waive trademark or patent rights. PrivacySafe® and 3NWeb® are registered trademarks. PrivacySafe Foundation™ and Ivy Cyber™ are pending trademarks. This dedication does not grant permission to use these marks in a manner that suggests sponsorship, endorsement, affiliation, or origin.