**Safe host-side configuration verification and benign HTTP filter testing — not an exploit, malware scanner, vulnerability confirmation, or guarantee of protection.**
This repository contains a baseline-vs-mitigated test for temporary PHP exposure-reduction controls discussed in connection with CVE-2026-109618 and CVE-2026-109619. It also provides deployment examples for Apache, Nginx, PHP-FPM, Docker and Cloudflare. **Apply vendor-patched PHP packages as soon as available.** The examples are *precautionary*, not officially confirmed fixes for either CVE.
> **Never upload this entire repository to a public web root.** It contains a non-working example token. Generate your own unique secret *before uploading*, restrict access to the testing directory, and remove it after testing. Do not publish rotated tokens or diagnostic output.
Requires Python 3.9+ locally, a PHP-enabled test host, and HTTPS.
# 1. Clone or download to a PRIVATE local directory
# 2. Upload ONLY these paths, inside a temporary access-restricted directory:
# 3. Open
# Enter the token printed at step 1; do not it.
# Optional CLI comparison (run from the SAME local rotated checkout):
python3 local-tools/compare.py
# 4. Delete the entire uploaded audit directory after verification.
**Never commit a checkout after rotating its token.** Prefer a separate deployment copy: `cp -a php-cve-defensive-audit-kit-github php-audit-private-deployment` then run `rotate_token.py` in the deployment copy. `tests/check_release.py` prevents distributing active-looking secrets in a public checkout.
- `01-baseline/`: protected diagnostics, **no added PHP CVE mitigation**.
- `02-mitigated/`: protected diagnostics with experimental `.htaccess` multipart filtering and `.user.ini` upload-progress setting.
- `index.html`: same-origin browser comparison dashboard.
- `local-tools/compare.py`: CLI benign HTTP comparison.
- `local-tools/php_inventory.py`: optional local read-only PHP binary inventory.
- `local-tools/rotate_token.py`: mandatory per-install token generation.
- `examples/`: **illustrative**, not universal, live-site configurations and rollback notes.
- `README-START-HERE.md`: detailed operations guide.
- `tests/`: no-network release consistency checks.
| Upload progress reports disabled | That runtime has the temporary setting active; **not proof of safety** |
| Ordinary POST 200 | Benign request reached PHP |
| Multipart POST 403 and no PHP marker | Consistent with an upstream block for the tested request; not CVE immunity |
| Multipart POST 404 | **Inconclusive**; check Apache deny-canary and server/WAF logs |
| Cloudflare response header present | Some traffic traversed Cloudflare; **not evidence particular WAF rules are enabled** |
**Danger of blanket blocking:** multipart POST restrictions can break media uploads, form submissions and APIs. Test staging first; back up configurations and prepare to roll back. On an Nginx-only site `.htaccess` is ignored. PHP `.user.ini` settings can be delayed by CGI/FPM caching.
- [PHP official releases](
- [PHP upload progress configuration](
- [Syhunt community defensive toolkit](
- [Cloudflare WAF docs](
See [CONTRIBUTING.md](CONTRIBUTING.md), [SECURITY.md](SECURITY.md), and [LICENSE](LICENSE). Open an issue for reproducible, non-sensitive bugs or documentation improvements. **Do not post exploit payloads, client domains, logs containing private data, or live tokens.**
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
