Mike Saurbaugh

Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment: 1. Discovery with Nmap Common and alternative web ports; HTTP headers that may expose PHP versions: nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target> Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability. 2. Huntress: Monitoring and detection • Confirmed facts and remaining questions • Suspicious PHP child processes, shells and downloaders • Webshells and other post-exploitation activity • My process-watcher for Linux process visibility huntress.com/blog/php2shell-… 3. Vincent Schmalbach: Hardening and patching • Temporary nginx/Apache filters and upload-progress settings • WAF/origin bypass checks • Package and backport verification • PHP-FPM/worker restarts, container rebuilds • Side effects and checks for compromise vincentschmalbach.com/cve-20… Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.