php2shell.conf

# Orbisius PHP Security — php2shell stopgap (CVE-2026-109618 / CVE-2026-109619), nginx.
# Blocks the vulnerable request shapes with a 404 before PHP (via PHP-FPM) parses the body, for a
# PHP you can't patch yet. STOPGAP, not a fix — update PHP, then remove this. Educational use, no
# warranty, you are responsible for what you deploy. Full setup, caveats and proof steps: README.
#
# nginx evaluates this in TWO contexts, so the rule is in two parts:
#   PART 1 — the maps below — go in http {} context (e.g. drop this file in /etc/nginx/conf.d/).
#   PART 2 — the rule below — goes inside each server {} that serves the site (shown commented at bottom).
#
# EDIT the allowlist: replace 203.0.113.5 / 198.51.100.7 (they match nobody) with your admin IPs
# or CIDR ranges in the geo block (one "IP 1;" or "CIDR 1;" per admin). Behind a CDN / proxy nginx
# sees the proxy IP — restore the real client IP first (set_real_ip_from / real_ip_header), and
# never allowlist the proxy IP. See the README. The $orb_* names are prefixed to avoid clashes.

# ===== PART 1 — put in http {} context =====
geo $orb_allow {
    default 0;
    203.0.113.5 1;   # <-- REPLACE with your admin IP/CIDR — placeholder, matches nobody as-is
    198.51.100.7 1;  # <-- REPLACE with your admin IP/CIDR — placeholder, matches nobody as-is
}

map $request_method $orb_has_body {
    default 1;
    GET 0;
    HEAD 0;
}

map $http_content_type $orb_multipart {
    default 0;
    "~*multipart/form-data" 1;
}

map $http_content_length $orb_large {
    default 0;
    "~[0-9]{7,}$" 1;
}

map "$orb_multipart$orb_large" $orb_badbody {
    default 1;
    "00" 0;
}

map "$orb_allow$orb_has_body$orb_badbody" $orb_block {
    default 0;
    "011" 1;
}

# ===== PART 2 — put inside each server {} (or the PHP location) that serves the site =====
# Reject a multipart or >=1MB body on any body-carrying method from a non-allowlisted client:
#     if ($orb_block) {
#         return 404;
#     }
#
# Optional backstop for a CHUNKED large body (no Content-Length). nginx's cap is GLOBAL — it
# can't be per-IP (no variable), so it caps admins too (like the Apache 2.2 edition). Keep it
# under ~1 MiB. Uncomment inside the server/location to enable:
#     client_max_body_size 512k;