❤️ Support PrivacySafe Foundation
This repository contains security mitigations, system-hardening scripts, and auditing tools developed for PrivacySafe and Ivy Cyber infrastructure. We publish these tools so that others can study, adapt, and use them to protect their own systems, including when upstream security fixes are not yet available.
57 scripts addressing 139 CVEs across 67 software projects and 10 programming languages, plus 4 other global security incidents.
💚 If this work is helpful, please consider supporting PrivacySafe Foundation, a 501(c)(3) nonprofit public charity supporting Free/Libre and Open Source Software (FLOSS), cybersecurity education, and public-interest privacy and security research.
| Patch | Targets | CVEs | Type |
|---|---|---|---|
| PHP2Shell | PHP-FPM 7.0 through 8.5 on Debian/Ubuntu/Trisquel and derivatives | CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 | Interim mitigation |
| PHP2Shell live watch | PHP-FPM, Apache and nginx logs on any GNU/Linux; optional systemd unit | CVE-2026-109618, CVE-2026-109619 | Read-only live monitor |
| PHP2Shell on cPanel | cPanel/WHM servers running EasyApache 4 PHP (ea-php74 to ea-php85), any handler | CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 | Interim mitigation, check and audit |
| PHP session audit | Any PHP host | CVE-2026-115560 | Read-only audit |
| PHP2Shell edge guards | Apache httpd (server configuration or .htaccess) and nginx in front of PHP, with request body and header limits, and a curl tester |
CVE-2026-109618, CVE-2026-109619 | Compensating controls (log-only first) |
| PHP2Shell detection rules | auditd, Tetragon and nftables on GNU/Linux | CVE-2026-109618, CVE-2026-109619 | Detection content |
| Node.js October 2026 | Node.js on GNU/Linux; systemd for the guard | CVE-2026-111497 (Brotli, ecosystem-wide) and 9 Node CVEs | Interim mitigation (Node only) |
| Brotli checker | libbrotli and the processes using it, plus Node/Bun/Python/Ruby/PHP/Envoy/Istio/cdxgen and containers on GNU/Linux | CVE-2026-111497 (Broccoli2Shell) | Read-only check and audit |
| Ruby and GitLab Regexp | Ruby runtimes, Ruby apps and GitLab on GNU/Linux | CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 | Read-only check and audit |
| libheif HEIF/AVIF Decoder | libheif, ImageMagick and Discourse on GNU/Linux | writeup; DSA-6417-1 | Check, audit and ImageMagick coder mitigation |
| eMudhra CA Compromise | System CA store on Debian/Ubuntu/Trisquel and derivatives | disclosure; Go: CVE-2026-111943 | Interim mitigation |
| curl HTTP/2 upload | curl and libcurl on GNU/Linux | CVE-2026-92392 | Read-only check and audit |
| openapi-typescript-codegen | Projects, CI jobs and generated TypeScript clients on GNU/Linux | CVE-2026-108551 (unpatched) | Read-only check and generated-code scan |
| Nextcloud Collabora Built-in CODE | Nextcloud with the richdocumentscode app on GNU/Linux | CVE-2026-110447 | Interim mitigation, check and hunt |
| nginx October 2026 | nginx and njs on GNU/Linux | CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629; njs: CVE-2026-101019, CVE-2026-101025 | Read-only check, config audit and hunt |
| LiteLLM supply-chain compromise | litellm in Python environments and containers on GNU/Linux | incident (litellm 1.107.0, no CVE) | Detect, hunt and contain |
| Plex Media Server Plex2Shell | Plex Media Server on GNU/Linux | CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 | Read-only check and hunt |
| GhostAction developer-machine stealer | Git repositories and developer machines on GNU/Linux | incident (campaign, no CVE) | Scan, hunt and contain |
| WordPress XSS2Shell | WordPress Core sites and their web server logs on GNU/Linux | CVE-2026-64638 | Read-only check, audit and hunt |
| WordPress plugins October 2026 | LiteSpeed Cache, Rank Math PRO, OttoKit, SureCart, LatePoint, Amelia, Profile Builder and Bricksforge (exploited upload to code execution) in WordPress installs on GNU/Linux | CVE-2026-113500, CVE-2026-111862, CVE-2026-110372, CVE-2026-112241, CVE-2026-110653, CVE-2026-112327, CVE-2026-112242, CVE-2026-85097 | Read-only check and hunt |
| Apache Tomcat October 2026 | Apache Tomcat 9.0, 10.1 and 11.0 on GNU/Linux | CVE-2026-103119, CVE-2026-101356 | Read-only check |
| Laravel TokenGuard | Laravel apps on GNU/Linux | CVE-2026-114509 | Read-only check and stopgap middleware |
| Pillow 13.0.0 | Pillow in Python environments and lock files on GNU/Linux | CVE-2026-96639, CVE-2026-112900 | Read-only check |
| Drupal Webform | Drupal sites with the Webform module on GNU/Linux | CVE-2026-96355 | Read-only check |
| Roundcube Webmail October 2026 | Roundcube on GNU/Linux, including copies bundled by hosting panels | CVE-2026-114716 | Read-only check and hunt |
| Next.js Server Actions | Next.js projects on GNU/Linux | CVE-2026-94482 | Read-only check |
| Craft CMS | Craft CMS 4.x and 5.x projects on GNU/Linux | CVE-2026-112777 | Read-only check |
| libexpat billion laughs | libexpat, Python's pyexpat and programs that embed expat on GNU/Linux | CVE-2026-115506 (fix planned for 2.9.1, not yet released) | Read-only check and embedded-copy scan |
| HAProxy HTTP/2 PING | HAProxy 3.1 to 3.4 on GNU/Linux | CVE-2026-110353 | Read-only check and config audit |
| Drupal core Field UI and Entity List | Drupal 8.9 to 12 sites on GNU/Linux (end-of-life branches get no patch) and the contributed Entity List module | CVE-2026-108097, CVE-2026-108099 | Read-only check |
| Apache CouchDB | Apache CouchDB 3.5.2 and earlier on GNU/Linux | CVE-2026-86471 | Read-only check |
| Django REST framework | DRF installs and pinned dependencies on GNU/Linux | CVE-2026-114138, CVE-2026-114137 | Read-only check |
| YOOtheme Pro | YOOtheme Pro 5 on WordPress and Joomla (CVSS 10.0) | CVE-2026-102785 | Read-only check and hunt |
| ISC BIND 9 | BIND 9 name servers on GNU/Linux (9.18 and older get no upstream fix) | CVE-2026-94300 | Read-only check |
| rsyslog dynaFile | rsyslog configurations on GNU/Linux (no release fully patched) | CVE-2026-92709 | Read-only configuration audit |
| Gitea | Gitea up to 28.1.0 that trusts a user SSH certificate authority | CVE-2026-109553 | Read-only check |
| Apache Traffic Server | Traffic Server 8.x to 10.2.0 that loads the experimental magick or tsmemcache plugin (CVSS 10) | CVE-2026-111813, CVE-2026-111811 | Read-only check |
| Grav Login plugin | Grav CMS sites with Login 3.6.0 to 3.9.12 | CVE-2026-114658 | Read-only check and hunt |
| Grav core allowlist bypass | Grav 2.0.15 to 2.2.12: a page editor can run arbitrary public static methods | CVE-2026-116019 | Read-only check and hunt |
| Sentry for Next.js | Next.js apps using @sentry/nextjs with tunnelRoute on a webpack build |
CVE-2026-114139 | Read-only check |
| Jupyter Server and nbconvert | Jupyter Server 2.0 to 2.5 with a gateway and a custom authorizer, and nbconvert 5.4 to 7.17.1 | CVE-2026-114135, CVE-2026-114140 | Read-only check |
| Storybook | Storybook 8 to 11-alpha dev servers reachable from the network | CVE-2026-114126 | Read-only check |
| Apache Pulsar and Pulsar Manager | Pulsar brokers with the MultiRoles authorization provider and an anonymous role, or a proxy role; and any Pulsar Manager (retired, no fix) | CVE-2026-105869, CVE-2026-105942, CVE-2026-105944 | Read-only check |
| Amazon SageMaker Python SDK | SageMaker SDK V2 before 2.257.3 and V3 before 3.10.0 (default bucket takeover) | CVE-2026-112408 | Read-only check |
| Incus | Incus 6.0 before 6.0.7, 7.0 before 7.0.2 and 7.1 to 7.4: a confined client can write to the host as root | CVE-2026-115375, CVE-2026-115377, CVE-2026-115372 | Read-only check |
| LiteLLM proxy admin escalation | LiteLLM proxy 1.87.0 up to the fixed release on each line | CVE-2026-114612 | Read-only check |
| WordPress page-template path traversal | WordPress core 4.7.0 to 7.1.1: unauthenticated path traversal, local PHP file inclusion, exploited in the wild | CVE-2026-87902 | Read-only check and hunt |
| Magento, Adobe Commerce and Mage-OS BlockStrap | Magento and Adobe Commerce 2.4.4 to 2.4.9, and Mage-OS below 3.6.0: a CVSS 10.0 unauthenticated email-template engine flaw | CVE-2026-103849 | Read-only check |
| Zammad session hijack and privilege escalation | Zammad 6.3.0 to 6.5.4: session hijack to code execution as the zammad user, chained to root, exploited in the wild | CVE-2026-102489, CVE-2026-102490 | Read-only check and hunt |
| Linux kernel ebtables SNAT | The Linux kernel on every distribution: out-of-bounds write in the ebtables SNAT ARP rewrite, exploited in the wild | CVE-2026-53266 | Read-only check |
| Linux kernel local root quartet | The Linux kernel on every distribution: four local privilege escalations with public exploits (IPsec AH6, TUN/TAP, PPPoE, SCTP), each fixed at a different release per branch | CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469 | Read-only check |
| nginx-ui restricted-directive bypass | nginx-ui below 2.4.1: a logged-in user can bypass the restricted-directive check, which leads to code execution where nginx loads njs, Perl or Lua | CVE-2026-84316, CVE-2026-84317, CVE-2026-84318, CVE-2026-84319 | Read-only check and hunt |
| Joomla core, September 2026 release | Joomla 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3: 16 core fixes, two rated High (directory deletion, SSRF) | CVE-2026-90915, CVE-2026-92222, CVE-2026-92227 and others | Read-only check |
| OpenSSL DTLS heap disclosure | OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 before their fixed releases: a High flaw reachable through DTLS | CVE-2026-84782 | Read-only check |
| Jenkins plugins, advisory of 16 September 2026 | 13 Jenkins plugins including Script Security (eight High sandbox bypasses) | CVE-2026-92122 to CVE-2026-92141 | Read-only check |
| GitLab security releases, October 2026 | Self-managed GitLab: seven High flaws from the 12 and 21 October releases (cross-site scripting, pipeline authorization, cache poisoning, an LDAP account takeover, a Duo prompt injection). 19.2.9 is not a full fix | CVE-2026-92883, CVE-2026-16301, CVE-2026-14814, CVE-2026-81839, CVE-2026-96893, CVE-2026-15723, CVE-2026-112212 | Read-only check |
| baserCMS 5 | baserCMS 5.0.0 to 5.4.1 (before 5.3.2 and 5.4.2): admin SQL injection, path traversal, and deserialization leading to command execution | CVE-2026-114621, CVE-2026-114622, CVE-2026-114624 | Read-only check |
| nginx-ui directive injection | nginx-ui below 2.4.1: authenticated directive injection leading to RCE when nginx loads njs/Perl/Lua | CVE-2026-84316, CVE-2026-84317, CVE-2026-84318 | Read-only check |
| wp2shell, WordPress core RCE | WordPress core 6.8.0 to 6.8.5, 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1: unauthenticated remote code execution, exploited in the wild | CVE-2026-63030, CVE-2026-60137 | Read-only check and hunt |
Each release ships three files, all named psf-security-packages and versioned by release date, YY.MM.DD-X.Y.Z (for example 26.10.28-1.0.0). Download them from the releases page on Codeberg or GitHub.
| File | For |
|---|---|
psf-security-packages_26.10.28-1.0.0_all.deb |
Debian, Ubuntu, Trisquel and derivatives |
psf-security-packages-26.10.28-1.0.0.noarch.rpm |
RHEL, Alma, Rocky, Fedora, CloudLinux and derivatives |
psf-security-packages-26.10.28-1.0.0.tar.gz |
Any GNU/Linux: the source tree, plus the scripts to rebuild the packages |
Check the files against the release's SHA256SUMS-<version>.txt before installing, then:
sha256sum -c SHA256SUMS-26.10.28-1.0.0.txt
sudo apt install ./psf-security-packages_26.10.28-1.0.0_all.deb # Debian family
sudo dnf install ./psf-security-packages-26.10.28-1.0.0.noarch.rpm # RPM family
/opt/psf-security-patches/php/php2shell-mitigate.sh check # read only/opt/psf-security-patches/holds the whole tree: each tool in its own folder (php/,nginx/,curl/and so on) with its README, plus the governance documents and aVERSIONfile. Run the scripts from there./usr/lib/systemd/system/php2shell-watch.serviceis the live watcher's unit, pointed at the/optpath. It is installed but not enabled; see Watching live.- License files:
LICENSEandNOTICEcome with the package (/usr/share/doc/psf-security-packages/on Debian,/usr/share/licenses/on RPM systems), and the.debcarries acopyrightfile. Everything is CC0 1.0 Universal.
Installing runs nothing: there are no install or removal scripts. The only dependencies are bash 4.0 or newer and coreutils.
Install a newer release the same way and it replaces the old one in place. To remove the tools:
sudo apt remove psf-security-packages # Debian family
sudo dnf remove psf-security-packages # RPM familyRemoving the package deletes only the files it installed. It does not undo what a tool did to your system when you ran it, such as an ini drop-in, an AppArmor profile or a distrusted certificate. Use each tool's own cleanup, remove or restore command, described in its README, before you remove the package.
Each tool still targets the systems named in its own README: for example the PHP2Shell AppArmor mitigation is for Debian-family systems, and the cPanel variant is for EasyApache 4. See packaging/ for how releases are built and verified.
See the changelog for new tools and changes, newest first.
These scripts are used on our production systems and undergo testing, but they may require adaptation for other environments. Review the source code before running any script, test changes in a non-production environment where possible, and maintain current backups. This software is provided without warranty.
PrivacySafe Foundation is a 501(c)(3) nonprofit public charity supporting Free/Libre and Open Source Software (FLOSS), cybersecurity education, decentralized technology, documentation, standards work, and public-interest privacy and security research.
Security work doesn't stop when a disclosure drops at midnight. If this repository helped you protect your users, please help us keep doing it:
The Foundation website provides options for card donations, PayPal/Venmo, cryptocurrency, checks, and other forms of support. Donations are often tax-deductible in the USA. Federal EIN: 41-5237617.
Found a bug in a script, or have a mitigation that belongs here? Please fork and submit a focused pull request.
- Contribution terms:
CONTRIBUTING.md - Code of Conduct:
CODE_OF_CONDUCT.md - AI Contribution Policy:
AI_POLICY.md - Security and vulnerability reporting:
SECURITY.md
- PrivacySafe: Privacy-by-design software for home, teams, and organizations. Sign up free, no phone number required.
- Bits On Tape: Our newsletter covering cybersecurity, privacy, FLOSS, AI, and digital culture.
- Ivy Cyber: Hosting, enterprise deployment, training, and technical support, including help hardening your own infrastructure.
Security patches belong to everyone. To the extent possible under law, Ivy Cyber LLC has waived all copyright and related or neighboring rights to this repository, including its scripts and documentation, under the Creative Commons CC0 1.0 Universal Public Domain Dedication (CC0-1.0). Feel free to copy, remix, and share. If you'd like to give back, please donate to PrivacySafe Foundation 501c3 nonprofit.
See NOTICE and LICENSE. Third-party components retain their original copyrights and licenses.
CC0 does not waive trademark or patent rights. PrivacySafe® and 3NWeb® are registered trademarks. PrivacySafe Foundation™ and Ivy Cyber™ are pending trademarks. This dedication does not grant permission to use these marks in a manner that suggests sponsorship, endorsement, affiliation, or origin.