How do you handle errors triggered by RCE CVE-2025-54068 bots?

[ghbob]

Maybe someone has some advice for me :)

Ever since this CVE has been exploited actively (so December, great write up btw) we get quite a few bots trying it out.

We patched it in July, of course, but they do trigger a /update/livewire 500 error each time.

e.g. TypeError: Cannot assign array to property App\Http\Livewire\some\component::$someProperty of type ?string

We started to block whoever triggers these too often with fail2ban, so something like this:

filter

[Definition]
failregex = ^<HOST> .* "POST /livewire/update HTTP/[^"]+" (500)
ignoreregex =

jail

[livewire-500]
enabled = true
port = http,https
filter = livewire-500
backend = auto
logpath = /var/log/nginx/<some-log>.log
maxretry = 5
findtime = 60
bantime = 86400
action = %(action_mwl)s

Any other suggestions?

Thanks!

[ventrec]

Bumping this.

We're also experiencing this and having issues with bugsnag being littered with these kinds of errors.

Any suggestions?

[joshhanley]

@ghbob and @ventrec we've added some checks into v4 which covered this. I've just backported them to v3 yesterday, so they will be in the next release. See PR #10203. But I'd recommend upgrading to v4 when you can as it has a bunch of improvements, like this.