Skip to content

Releases: PrivacySafe/security-patches

Release list

psf-security-packages 26.10.25-1.0.0

psf-security-packages 26.10.25-1.0.0 Latest
Latest

Choose a tag to compare

View all tags
@profdiggity profdiggity released this 25 Oct 02:35
security-packages
e631072
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Free public domain tools for GNU/Linux servers: check whether you are exposed, hunt for signs of exploitation, and apply interim mitigations where the vendor fix is not enough. Built and published by PrivacySafe Foundation 501(c)(3) nonprofit with the assistance of Ivy Cyber LLC.

Why this exists

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) leaked on the night of 20 October. Our interim mitigation was written that night, then tested and published on the morning of 21 October, before PHP published its fixes and before GNU/Linux distributions shipped theirs. Until 21 October there were no fixed packages from PHP or the distributions to install, so an interim mitigation was the only thing a server operator could deploy. This repository is that work, grown into a set of tools for the deluge of vulnerabilities and exploits facing system administrators.

What is in this release

  • PHP2Shell: interim mitigation (ini drop-in plus a per-version AppArmor profile for PHP-FPM 7.0 to 8.5), patch detection that understands upstream versions and distribution backports, hunt for log triage, a live watcher with a systemd unit, a cPanel/EasyApache 4 variant, Apache and nginx edge guards, and auditd, Tetragon and nftables detection content.
  • Nextcloud Collabora Built-in CODE: mitigation, check and hunt for CVE-2026-110447, exploited in the wild.
  • nginx October 2026: version check plus nginx -T config audit for the five flaws fixed in 1.30.6 and 1.31.7, and the two njs fixes.
  • curl HTTP/2 upload: check for CVE-2026-92392.
  • Brotli: host, runtime and container checker for CVE-2026-111497, including Node.js, Python brotlicffi and cdxgen.
  • libheif: HEIF/AVIF decoder check with ImageMagick and MediaWiki hardening.
  • Ruby and GitLab: Regexp fix checker for Ruby and the GitLab CVEs.
  • Plex Media Server: check and hunt for the Plex2Shell RCE chain.
  • LiteLLM 1.107.0: detect, hunt and contain the supply-chain compromise.
  • GhostAction: scan, hunt and contain the developer-machine stealer.
  • PKI (eMudhra): mitigation script.

16 scripts across 12 folders. Every shell script passes bash -n and ShellCheck at warning severity, and every link and anchor in the documentation resolves.

Install

Three files, all named psf-security-packages and versioned by release date:

  • psf-security-packages-26.10.25-1.0.0.tar.gz (source tarball)
  • psf-security-packages_26.10.25-1.0.0_all.deb (Debian, Ubuntu, Trisquel)
  • psf-security-packages-26.10.25-1.0.0.noarch.rpm (RHEL, Alma, Rocky, Fedora, CloudLinux)
sha256sum -c SHA256SUMS-26.10.25-1.0.0.txt
sudo apt install ./psf-security-packages_26.10.25-1.0.0_all.deb     # or: sudo dnf install ./psf-security-packages-26.10.25-1.0.0.noarch.rpm
/opt/psf-security-patches/php/php2shell-mitigate.sh check           # read only, no root needed

Everything installs to /opt/psf-security-patches, plus the php2shell-watch systemd unit, which is not enabled. No scripts run at install time. Prefer git? Clone from Codeberg or the GitHub mirror.

Each folder has its own README with the commands, what each one changes, and how to roll it back. Start with check or hunt, which change nothing.

Please read

  • Patching is the fix. These tools reduce risk while you patch and help you find out whether you were hit. They are not a substitute for upgrading.
  • A hunt hit is a lead to investigate, not proof of compromise. A clean hunt is not proof you were not.
  • Verify checksums in SHA256SUMS.txt before running anything as root.

Support the work

If this software is helpful, please donate to PrivacySafe Foundation, a 501(c)(3) nonprofit: https://privacysafe.foundation

License

CC0 1.0 Universal. Copy, remix and share. See LICENSE and NOTICE.

Full Changelog: https://github.com/PrivacySafe/security-patches/commits/security-packages

Assets 10
Loading