Glossary: PHP and IT security

125 technical terms in plain words, each with a reference to the matching specialist page.

#A B C D E F G H I J L M N O P R S T U V W X Z

#

2FA: 2FA (two-factor authentication) requires a second proof at login in addition to the password, such as a code from an app or a security key. A stolen password alone is then no longer enough. 2FA should be standard for all admin access to CMS, hosting panels and servers. Setting up two-factor authentication for admin access →
3-2-1 backup: The 3-2-1 rule recommends three copies of the data on two different storage media, one of them at a different location. At least one copy should be unalterable from the server, so that attackers cannot delete or encrypt it. A backup only counts once restoration has been tested. Server backup strategy: backups using the 3-2-1 rule →

A

Apache: The Apache HTTP Server is one of the oldest and most widely used web servers. PHP runs in it either as a module (mod_php) or via PHP-FPM through FastCGI. With .htaccess files the configuration can be adjusted per directory. Securing Apache with mod_php →

B

Backdoor: A backdoor is a hidden access through which attackers can return after a break-in. It can be a file, an admin account, a cron job or an SSH key. That is why every cleanup includes a search for all kinds of access, not just files. Finding a WordPress backdoor: tracking down backdoors systematically →
Backport: A backport transfers a security fix into an older program version without switching to the new version. Linux distributions and hosts often do this; the displayed version number then stays the same. Whether a backport has been applied is shown by the package changelog and confirmation from the provider, not by the number. PHP Upgrade or Backport? The Decision for Legacy Systems →
Brute force: In a brute-force attack, an attacker automatically tries many passwords for an account. Targets are often admin logins of CMS, SSH or FTP. Protection comes from strong passwords, two-factor login and automatic lockouts such as Fail2ban. Protecting admin logins against brute force: brute-force protection for every login →
BSI: The BSI (German Federal Office for Information Security) is the German federal government's cybersecurity authority. It publishes warnings, recommendations and standards such as IT-Grundschutz. On PHP2Shell, the BSI declared warning level 3 (orange) and recommended an immediate update. What the BSI Recommends on PHP2Shell →

C

CDN: A CDN (content delivery network) delivers content through many distributed servers and thus sits in front of the actual website. Many CDNs also offer WAF rules, for example Cloudflare against PHP2Shell. The protection works only for traffic through the CDN and does not replace a PHP update. Cloudflare Protection Rules Against PHP2Shell: What They Do and Do Not Do →
CERT-Bund: CERT-Bund is the computer emergency response team of the German federal administration at the BSI. It publishes warning and information services on vulnerabilities and notifies network operators about vulnerable systems. CERT-Bund has also issued a warning about PHP2Shell. What CERT-EU and CERT-Bund Advise on PHP2Shell →
CERT-EU: CERT-EU is the cybersecurity team for the institutions, bodies and agencies of the European Union. According to reports, CERT-EU considers it possible that with PHP2Shell versions from PHP 5 onward are affected. It advises isolating publicly reachable applications if they cannot be patched promptly. What CERT-EU and CERT-Bund Advise on PHP2Shell →
CGI: CGI (Common Gateway Interface) is an old interface in which the web server starts an external program for every request and returns its output. It is simple but slow and has largely been replaced by FastCGI for PHP. Old CGI setups can still be found on some hosting and Windows systems. CGI and FastCGI: The Basics →
cgroups: cgroups (control groups) are a Linux kernel feature with which memory, CPU and other resources can be limited for groups of processes. Containers and systemd use them, for example with MemoryMax. As an interim measure against PHP2Shell, php.net recommends a memory limit via container or cgroup instead of via RLIMIT_AS or RLIMIT_DATA. Setting Memory Limits With systemd and cgroups →
Chain of custody: The chain of custody documents without gaps who secured, handed over and processed a piece of evidence and when. Supplemented by checksums, it proves that data was not altered. Without this documentation, traces lose value in court or towards insurers. IT Forensics After a Web Server Attack →
Changelog: A changelog lists the changes in a program or package version, for security fixes usually with the CVE number. On Debian and Ubuntu, apt-get changelog shows the package changelog; in the RHEL family, rpm -q --changelog. This makes it possible to prove a backport even when the version number is the same. Proving CVE Numbers in the Package Changelog →
CLI: CLI (Command Line Interface) is PHP on the command line, for example for cron jobs, CMS console commands and Composer. The CLI PHP can be a different version from the PHP that serves web pages. The command php -v therefore shows only the command-line version; both routes must be patched. PHP on the Command Line (CLI) →
CloudLinux: CloudLinux is a Linux distribution for shared hosting that separates customers into limited environments. With alt-php it provides many PHP versions side by side, including older ones. Each of these versions must be patched individually. CloudLinux and alt-php: What Hosting Customers Should Know →
Command injection: In command injection, input reaches a system command that the application executes without being validated. The attacker can thus start their own commands with the web server's rights. Protection comes from avoiding shell calls where possible and consistent escaping with escapeshellarg(). Preventing Command Injection in PHP →
Composer: Composer is the package manager for PHP. It installs libraries according to the details in composer.json and records the exact versions in composer.lock. With composer audit, installed packages can be checked for known vulnerabilities; vulnerabilities in PHP itself are not found by the command. Composer: The Package Manager for PHP →
Container: A container is an isolated runtime environment that starts an application with all its dependencies from an image, for example with Docker. The PHP in the container comes from the image, not from the host system. An update on the host therefore does not patch it; the image has to be rebuilt and the container restarted. Running PHP in Containers →
cPanel: cPanel is a management panel for web hosting, with WHM as the interface for the server administrator. PHP versions are usually provided there via dedicated packages (EasyApache). Which builds are patched is confirmed by the package version and the host. cPanel and WHM: Securing PHP →
Credential stuffing: In credential stuffing, attackers try credentials from earlier data leaks at other services. It works because many people reuse passwords. Protection comes from unique passwords per service and two-factor login. Setting up two-factor authentication for admin access →
Cryptominer: A cryptominer is malware that computes cryptocurrency on other people's servers. Typical signs are permanently high CPU load and unknown processes. A miner shows that an attacker can execute code; the server should then be considered compromised. Crypto Miner on the Web Server: Signs and Procedure →
CSP: CSP (Content Security Policy) is a header that defines from which sources a page may load scripts, images and other content. It makes XSS and the injection of foreign scripts harder, for example in skimming. A strict CSP must be tested carefully so that the website keeps working. Security headers for websites: setting them correctly →
CSRF: CSRF (cross-site request forgery) makes the browser of a logged-in user unwittingly trigger an action on another website. Typical are changes in admin areas. Protection comes from random tokens in forms and cookies with the SameSite attribute. CSRF Protection in PHP Applications →
CVE: CVE (Common Vulnerabilities and Exposures) is a globally used directory that gives every known security vulnerability a unique number, such as CVE-2026-109618. The number makes announcements from vendors, authorities and distributions comparable. The CVE number can also be used to check in the package changelog whether a fix has been applied. Proving CVE Numbers in the Package Changelog →
CVSS: CVSS (Common Vulnerability Scoring System) rates the severity of a vulnerability on a scale from 0 to 10. The rating takes into account, for example, whether an attack is possible over the network and without logging in. The PHP2Shell vulnerabilities each have CVSS v4.0 9.2; the score alone says nothing about the concrete risk in your environment.
Cyber insurance: Depending on the contract, cyber insurance covers costs after an attack, such as forensics, restoration or business interruption. Many policies contain obligations such as timely updates and immediate notification of the loss. What applies in an individual case, you clarify with your insurer. Cyber Insurance: What Counts in a Claim →

D

DDoS: A DDoS attack (distributed denial of service) overloads a service with requests from many sources until it is no longer reachable. Data is generally not stolen in the process. A DDoS is to be distinguished from an exploit that targets a specific vulnerability. DDoS or hack? Classifying attacks correctly →
Defacement: In defacement, attackers visibly change a website's home page or content, for example with messages or images. It is conspicuous but often only the visible sign of a deeper break-in. The website should be treated as compromised until clarified. Website Hacked, What to Do? Remote Emergency Help →
Deserialization: Deserialization converts stored data back into objects, in PHP for example with unserialize(). If the data comes from users, attackers can construct objects so that unwanted code runs when they are loaded. For user data, JSON is the safer choice. Insecure deserialization in PHP: unserialize and security →
disable_functions: disable_functions is a php.ini setting that disables individual PHP functions, typically those for executing system commands. It can only be set in php.ini, not in application code. It makes life harder for attackers but replaces neither updates nor clean permissions. Using PHP disable_functions correctly →
display_errors: display_errors determines whether PHP shows error messages directly in the browser. In production the value belongs on Off; errors are instead written to a log with log_errors. Visible messages otherwise reveal paths, versions and code snippets. display_errors off: Disabling Error Output in Production →
DPA: A DPA (data processing agreement) under Art. 28 GDPR is necessary if a service provider processes personal data on behalf of a controller or can access it. This often also applies to hosts, agencies and IT service providers with server access. The contract regulates, among other things, instructions, protective measures and reporting channels. Data Processing When Service Providers Access Servers →

E

EDR: EDR (Endpoint Detection and Response) is software on servers and workstations that observes processes, file access and network connections and reports or stops suspicious behaviour. On web servers it can, for example, detect that PHP-FPM starts a shell. Since there are no confirmed IOCs for PHP2Shell, such behavioural analysis is particularly important. Warning Sign: The Web Server Starts a Shell →
Embargo: An embargo is the agreed period during which the details of a vulnerability remain confidential until patches are ready. This allows vendors and distributions to prepare updates. With PHP2Shell, according to several reports, details became public before the embargo expired; php.net therefore announced the patches on 20 October 2026. Why the PHP Vulnerability Became Known Before the Patch →
Emergency plan: An IT emergency plan sets out who does what in an incident: contacts, decision paths, first steps, restart. It must also be available offline in case systems fail. Regular exercises show whether it works in a real emergency. Creating an IT Emergency Plan for Web Servers →
End of life: End of life (EOL) means that a software version no longer receives updates from the vendor, including security fixes. PHP 8.1 and older no longer receive official updates from the PHP project; for 7.4, 8.0 and 8.1 there are only minimal source backports. Systems with EOL software need an upgrade plan. PHP end of life: risks of outdated versions →
Evidence preservation: Evidence preservation means securing traces of an incident before they are lost through cleanup, restart or reinstallation. This includes log files, images of storage media and, depending on the case, memory. After PHP2Shell, the trade press advises keeping server logs from 20 October 2026 onward. Preserve Evidence Before You Rebuild the Server →
Exploit: An exploit is code or a method that actually exploits a specific vulnerability. As soon as a patch appears, attackers can analyse it and derive exploits. That is why the time until attacks often shortens considerably after a patch is published. The Time Window Between Patch and Attack →
expose_php: expose_php controls whether PHP reveals its version in the HTTP header X-Powered-By. In production the setting should be Off, so that attackers cannot see at a glance which PHP version is running. This is information protection, not a replacement for an update. expose_php and Server Headers: Hiding Version Information →
Extension: An extension adds functions to PHP, for example for databases, images or encryption. Extensions run in the same process as PHP and have the same rights. Disabling extensions that are not needed reduces the attack surface. Understanding PHP Extensions →

F

Fail2ban: Fail2ban reads log files and temporarily blocks IP addresses in the firewall after repeated failed attempts. Typical uses are SSH, mail and website admin logins. Against distributed attacks from many addresses, it helps only to a limited extent. Setting Up Fail2ban for Web Servers →
FastCGI: FastCGI is a protocol through which a web server passes requests to permanently running program processes, such as PHP-FPM. Unlike classic CGI, a new process is not started for every request. Because processes handle several requests in succession, a clean restart after updates is important. CGI and FastCGI: The Basics →
Forensics: IT forensics methodically investigates after an incident what happened: how the attacker got in, what they did and which data is affected. The basis is secured copies of storage media, memory and logs. The results are important for reporting duties, insurance and criminal complaints. IT Forensics After a Web Server Attack →
FPM pool: A pool is a group of PHP-FPM processes with its own configuration, its own socket and ideally its own system user. One pool per website separates the websites from each other, so that a break-in on one site does not directly reach the files of the others. Settings can be fixed in the pool with php_admin_value. Isolating PHP-FPM Pools per Website →
FrankenPHP: FrankenPHP is a modern application server for PHP based on the Caddy web server. PHP is embedded directly there; in worker mode the application stays in memory between requests. According to the PHP team, FrankenPHP is among the affected operating modes; after the update the server must be restarted with the new PHP. Securing FrankenPHP →

G

GDPR Art. 33: Art. 33 GDPR obliges controllers to report a personal data breach to the competent supervisory authority, where possible within 72 hours of becoming aware of it. The obligation lapses only if the breach is unlikely to result in a risk to the data subjects. In individual cases, data protection officers or lawyers can advise. GDPR Reporting Obligation: 72 Hours After the Incident →
GDPR Art. 34: Art. 34 GDPR governs the notification of the data subjects themselves. It is necessary if a data breach is likely to result in a high risk to their rights and freedoms. Whether that applies should be assessed with data protection officers or lawyers. GDPR Reporting Obligation: 72 Hours After the Incident →
GHSA: GHSA is the identifier of a GitHub Security Advisory, that is, a security notice in GitHub's database. Many open-source projects, including PHP, publish their notices there in addition to the CVE number. For PHP2Shell these are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

H

Hardening: Hardening means configuring a system so that it offers as little attack surface as possible: only necessary services, minimal rights, secure defaults. For PHP servers this includes separate pools, disabled functions and no PHP execution in upload folders. Hardening limits damage but does not replace updates. Server Hardening for PHP Web Servers →
HSTS: HSTS (HTTP Strict Transport Security) is a header with which a website tells the browser to access it only via HTTPS for a certain period. This prevents connections from being downgraded to unencrypted HTTP. Before enabling it, HTTPS should work reliably on all affected domains. Security headers for websites: setting them correctly →
.htaccess: .htaccess files are per-directory configuration files for Apache and compatible servers such as LiteSpeed. CMS use them for redirects and access protection, attackers for hidden redirects. Nginx does not evaluate .htaccess; protective rules have to go into the server configuration there. Configuring Apache for PHP Securely →

I

Image digest: An image digest is a hash value (sha256) that uniquely identifies the content of a container image. Unlike a tag such as php:8.3-fpm, which can be moved to new builds, a digest never changes. Anyone who pins images by digest must deliberately update it after a security update. Official PHP Docker Images: Tags, Digests and Rebuilds →
Incident response: Incident response is the orderly handling of a security incident: detect, contain, preserve evidence, clean up, restore and follow up. A defined procedure prevents evidence from being destroyed or back doors overlooked in the rush. Clear responsibilities and seamless documentation are important. Incident Response for Server Attacks →
ini_set(): ini_set() is a PHP function with which a script changes settings at runtime. What a script may change depends on the change mode of the setting. Because malicious code can also call ini_set(), protective settings belong in the server or pool configuration, not in the application code. The php.ini Explained: Structure, Levels and Precedence →
Integrity check: In an integrity check, files are compared with a known original state, usually via checksums. Many CMS offer their own commands for this, for example for WordPress, Nextcloud or Matomo. Customised files, uploads and database content are not covered by such a comparison. Comparing CMS Core Files With the Original →
IOC: IOCs (indicators of compromise) are concrete traces of an attack, such as file names, hash values, IP addresses or domains. They allow systems to be checked specifically for a known attack. For PHP2Shell there are no published, confirmed IOCs; detection relies on behavioural analysis. Am I Already Compromised? Signs After PHP2Shell →
ISO 27001: ISO/IEC 27001 is the international standard for information security management systems (ISMS). It requires a regulated approach to risks, measures and improvements, including vulnerability and incident management. Companies can have themselves certified against it. ISO 27001 and TISAX: What Concerns Web Servers →
IT-Grundschutz: The BSI's IT-Grundschutz is a methodology with modules and requirements for information security in companies and public authorities. There are dedicated modules, for example for web servers and web applications. It can be used as a basis for an ISMS or a certification. CIS Benchmarks and BSI Modules for Web Servers →

J

JIT: JIT (just-in-time compiler) translates frequently executed PHP code into machine code at runtime. It arrived with PHP 8.0 and is part of OPcache. For typical websites the performance gain is usually small; for compute-intensive tasks it is larger. JIT and Performance in PHP 8 →

L

Least privilege: Least privilege (the principle of minimal rights) means that every user and every process receives only the rights it really needs. If PHP runs with minimal rights, an attacker can do less damage after a break-in. This concerns system users, file permissions, database accounts and admin access. Least Privilege: Permissions of the Web Server User →
Lessons learned: Lessons learned is the follow-up to an incident: what happened, what went well, what has to change? The aim is concrete measures with responsible persons and deadlines, not blame. The results feed into the emergency plan, patch process and training. Lessons Learned: Getting Better After an Incident →
LFI: LFI (local file inclusion) occurs when an application includes a local file whose path the attacker can influence. This allows configuration files to be read or, under certain circumstances, planted code to be executed. Protection comes from fixed allow-lists instead of file names from user input. Preventing local file inclusion in PHP: LFI and RFI →
LiteSpeed: LiteSpeed is a web server that is largely compatible with Apache configurations such as .htaccess and connects PHP through its own interface, LSAPI. It is widespread among hosts; OpenLiteSpeed is the free variant. According to the PHP team, LiteSpeed is among the operating modes affected by PHP2Shell. LiteSpeed and LSAPI: Updating PHP →

M

Managed server: With a managed server, the provider supplies a dedicated server and takes over contractually defined parts of operations, often operating system and PHP updates. What exactly is included is set out in the contract and differs greatly between providers. When in doubt, responsibility for patches should be confirmed in writing. Managed Server: Clarifying Responsibility →
memory_limit: memory_limit limits how much memory a single PHP script may use; the default is 128 MB. When the limit is reached, PHP aborts with an out-of-memory error. Against CVE-2026-109618, php.net advises memory_limit=-1 as an interim measure, set permanently, together with a memory limit via container or cgroup. Setting memory_limit Correctly →
mod_php: mod_php is the PHP module for the Apache web server. PHP runs directly inside the Apache process and usually with its user rights. The PHP team rates the risk from PHP2Shell highest for mod_php; an exploit was demonstrated there before any application code even runs. mod_php Explained: PHP Inside the Apache Process →
ModSecurity: ModSecurity is a widely used open-source WAF that runs as a module in Apache, Nginx or other web servers. It evaluates requests against rules and can log or block them. It is usually deployed together with the OWASP Core Rule Set. Using ModSecurity and the OWASP Core Rule Set →
Monitoring: Monitoring is the ongoing surveillance of systems, such as availability, load, log files and file changes. Security monitoring looks specifically for anomalies such as new PHP files or shells started by the web server. It only helps if someone also assesses the alerts promptly. Security Monitoring for Web Servers →

N

Nginx: Nginx is a widely used web server and reverse proxy. It does not execute PHP itself but passes requests to PHP-FPM via FastCGI. What matters is a configuration that passes only real PHP files to PHP and excludes upload folders. Securing Nginx with PHP-FPM →
NIS2: NIS2 is an EU directive that sets out obligations on risk management and the reporting of security incidents for many companies and entities. It covers considerably more sectors and company sizes than the predecessor regime. Whether your company is covered should be clarified on the basis of national implementation and with legal advice. NIS2 and Web Server Security →

O

OPcache: OPcache is the bytecode cache that ships with PHP. It stores already compiled code in shared memory so that PHP files are not recompiled on every request. After an update or a cleanup, the cache must be cleared or PHP restarted, otherwise old code can keep running. OPcache Explained: PHP's Bytecode Cache →
open_basedir: open_basedir restricts which directories PHP scripts may access with file functions. On servers with several websites, this prevents one site from simply reading another's files. It is not complete isolation; separate system users and FPM pools belong with it. open_basedir and isolation per website →
Origin server: The origin server is the actual web server behind a CDN or reverse proxy. If it is also reachable directly via its IP address, attackers can bypass the protection in front of it. The origin should therefore accept connections only from the CDN or proxy. Cloudflare Protection Rules Against PHP2Shell: What They Do and Do Not Do →
Out of memory: Out of memory describes the state in which a program cannot get any more memory and has to abort. In PHP this happens when memory_limit is exceeded. With CVE-2026-109618, such an abort can interrupt PHP while request data is only partly initialised. memory_limit and Out-of-Memory: What Happens Inside →
OWASP CRS: The OWASP Core Rule Set (CRS) is a freely available rule set for ModSecurity and compatible WAFs. It detects typical attack classes such as SQL injection or command injection. The rules must be tuned to the application, otherwise they also block legitimate requests. Using ModSecurity and the OWASP Core Rule Set →
OWASP Top 10: The OWASP Top 10 is a regularly updated list of the most important risks for web applications, published by the non-profit OWASP Foundation. It serves as a basis for development, reviews and training. In addition, OWASP offers the Cheat Sheets with concrete countermeasures.

P

Patch: A patch is a fix from the vendor that closes a vulnerability in the program code. It only takes effect once it is installed and all running processes have been restarted. A patch does not remove malware that has already been planted and does not prove that nothing happened beforehand. PHP Patch Service: Update Installed, With Restart and Proof →
PECL: PECL (PHP Extension Community Library) is the repository for PHP extensions that are written in C and are not part of the standard distribution. Such extensions must match the installed PHP version. After a change of the PHP major version, they often have to be rebuilt or replaced. Understanding PHP Extensions →
PHP: PHP is a scripting language that runs mainly on web servers, where it generates web pages. Many widely used CMS and shop systems such as WordPress, TYPO3 or Shopware are written in PHP. A vulnerability in the PHP interpreter therefore affects every application running on it, regardless of that application's own update status. What Is PHP? The Programming Language Explained →
php-cgi: php-cgi is the PHP program for operation via CGI or FastCGI. According to the PHP team, it is one of the operating modes affected by PHP2Shell. Where php-cgi is still in use, it is worth checking whether a switch to PHP-FPM is possible. php-cgi: Legacy With Risk →
PHP-FPM: PHP-FPM (FastCGI Process Manager) is a separate service that manages PHP processes in pools and accepts requests from the web server via FastCGI. It is now the usual operating mode with Nginx and on many Apache servers. After a PHP update, PHP-FPM must be restarted so that no old processes keep running. PHP-FPM Explained: Process Manager, Pools and Workers →
php.ini: The php.ini is PHP's central configuration file. It sets limits, security and error settings, for example memory_limit or display_errors. There is often a separate php.ini for each SAPI (FPM, CLI, Apache), and each must be maintained separately. The php.ini Explained: Structure, Levels and Precedence →
PHP2Shell: PHP2Shell is the name for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, each with CVSS v4.0 9.2. They allow remote code execution without authentication. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. What Is PHP2Shell? The Vulnerability Explained Simply →
php_admin_value: php_admin_value sets a PHP setting in the FPM pool or in the Apache configuration in such a way that applications cannot override it via ini_set() or .htaccess. For switches there is php_admin_flag. php.net recommends this route for the interim measures against PHP2Shell, for example for memory_limit. php_admin_value: Locking Settings Against Overrides →
Plesk: Plesk is a widely used management panel for web servers, with which domains, PHP versions and handlers can be set per website. It brings its own PHP packages but can also use the distribution's PHP packages. With backports, Plesk may keep showing an older number such as 8.2.34 even though the system is patched. Plesk Server: Checking and Patching PHP Versions →
post_max_size: post_max_size sets how large the total content of a POST request may be; the default is 8 MB. As an interim measure against PHP2Shell, php.net names 8M for websites without uploads and 32M with uploads. upload_max_filesize must be lower. Sensibly Limiting post_max_size and upload_max_filesize →
Proof of concept: A proof of concept (PoC) is evidence that a vulnerability can be exploited, often as simple demonstration code. It serves vendors and researchers for assessment but can also serve attackers as a template. A published PoC therefore generally increases the urgency of patching.

R

Ransomware: Ransomware encrypts data and demands a ransom for decryption, often combined with the threat of publishing stolen data. A compromised web server can be the entry point. The most effective protection is separate, tested backups and an emergency plan. Server backup strategy: backups using the 3-2-1 rule →
RCE: RCE (Remote Code Execution) means that an attacker can execute their own code on a remote system. If no login is required for this, it is called unauthenticated RCE, the most severe class of web server vulnerabilities. With RCE an attacker can read data, create back doors and misuse the server further. What Is PHP2Shell? The Vulnerability Explained Simply →
Release cycle: Each PHP version first receives bug fixes and then, for a period, only security fixes. When each version ends is published by the PHP project on php.net under the supported versions. According to php.net, PHP 8.2 reaches the end of support on 31 December 2026. PHP Versions and the Release Cycle →
Reverse proxy: A reverse proxy accepts requests from the internet and forwards them to one or more servers behind it. It can handle TLS, distribute load and serve as a place for filter rules or a WAF. It offers protection only if the servers behind it are not also directly reachable. Filtering Upload Requests at the Edge: Opportunities and Risks →
RFI: RFI (remote file inclusion) is the variant in which an application loads and executes code from a foreign address. In PHP, the setting allow_url_include=Off, which has long been the default, prevents the inclusion of remote files. Old applications and configurations should be checked for this. Preventing local file inclusion in PHP: LFI and RFI →
Root server: A root server is a rented server on which the customer has full administrator rights. Full responsibility for updates, hardening and monitoring therefore also lies with the customer. The provider supplies only hardware and network. Securing Your Own Root Server and vServer →

S

SAPI: SAPI (Server Application Programming Interface) is the interface through which PHP talks to its environment, such as Apache, PHP-FPM or the command line. Which SAPI is in use determines how PHP processes are started, reused and restarted. For PHP2Shell, according to the PHP team, several operating modes are affected, with mod_php carrying the highest risk. SAPI Explained: How PHP Talks to the Web Server →
Security headers: Security headers are HTTP response header lines that give the browser protective rules, such as Content-Security-Policy, Strict-Transport-Security or X-Content-Type-Options. They protect visitors from certain attacks in the browser. Against vulnerabilities on the server such as PHP2Shell, they do not help. Security headers for websites: setting them correctly →
SEO spam: SEO spam is planted pages, links or redirects with which attackers place third-party offers in search engines. Often only search engines or visitors coming from Google see the manipulated content. Besides the cleanup, a review in Google Search Console is then necessary. SEO Spam and Foreign Pages in the Google Index →
serialize_handler: session.serialize_handler determines the format in which PHP stores session data, such as php, php_binary or php_serialize. The note on CVE-2026-115560 concerns only an unusual configuration in which this format is switched at runtime and session upload progress is active. The workaround until the next bugfix release is session.upload_progress.enabled=0. CVE-2026-115560: Session Upload Progress Advisory →
Session: A session links several requests from the same visitor, for example for login or shopping cart. PHP stores the data on the server side and gives the browser a session ID, by default in the cookie PHPSESSID. Anyone who knows another person's session ID can, under certain circumstances, act as that user. Sessions and Cookies in PHP →
session.upload_progress: Session upload progress is a PHP feature that stores the progress of ongoing file uploads in the session; it is enabled by default. php.net advises session.upload_progress.enabled=0 as an interim measure in php.ini, FPM pool or server configuration, followed by a restart of all workers. According to specialist reports, the setting alone does not close both PHP2Shell vulnerabilities; the update remains mandatory. Disabling session.upload_progress: Correctly and Permanently →
Shared hosting: With shared hosting, many customers share a server operated by the host. The host is responsible for PHP, the operating system and the web server, the customer for their application. For PHP2Shell this means: ask the host for the patch level and check your own website for traces. Shared Hosting: What the Host Does and What You Need to Do →
SIEM: A SIEM (Security Information and Event Management) collects log data from many systems centrally and analyses it for security events. This makes it possible to see connections that get lost in individual logs. A SIEM needs maintained rules and people who handle the alerts. Security Monitoring for Web Servers →
Skimming: In skimming in online shops, attackers inject JavaScript into the checkout that reads payment and customer data and sends it off. The code is often hidden in theme files, tracking scripts or database entries. Customers notice nothing; the merchant often only through notices from payment providers. Online Shop Hacked? IT Security for Merchants →
SQL injection: In an SQL injection, an attacker smuggles their own database commands into an application through inputs. This allows data to be read or changed. Protection comes from prepared statements with placeholders instead of concatenated SQL strings. Preventing SQL injection in PHP →
SSRF: SSRF (server-side request forgery) makes an application send requests to other addresses on the attacker's behalf, including to internal systems. This makes services reachable that are actually shielded from the outside. Protection comes from allow-lists for targets and blocking internal address ranges. Preventing Server-Side Request Forgery (SSRF) in PHP →
Superglobals: Superglobals are variables that PHP provides in every script, such as $_GET, $_POST, $_COOKIE, $_FILES, $_SERVER and $_SESSION. They contain the data of the current request, much of which comes from the visitor. Everything in them must be treated as untrusted and validated. Superglobals: $_GET, $_POST, $_FILES and More →
sury.org: sury.org is a package repository by Ondřej Surý with current and older PHP versions for Debian and Ubuntu. It is a third-party offering and not Debian's security archive. According to reports, builds for all branches from 5.6 to 8.5 were provided there. The sury.org Repository: PHP Packages from a Third-Party Source →

T

Threat hunting: Threat hunting is the active search for attackers in your own network without a warning having been raised. The starting point is hypotheses, for example: has a web server process started a shell since 20 October? This finds break-ins that automatic tools overlook. Warning Sign: The Web Server Starts a Shell →
Timeline: A timeline arranges all traces of an incident chronologically: log entries, file changes, logins, processes. It shows when the attack began and what happened in what order. A uniform time zone is important, ideally UTC. Building the Timeline of an Incident →
TISAX: TISAX is an assessment and exchange mechanism for information security in the automotive industry. It is based on a requirements catalogue from the German Association of the Automotive Industry (VDA) and is operated by the ENX Association. Suppliers use it to demonstrate their security level to manufacturers. ISO 27001 and TISAX: What Concerns Web Servers →
TLS: TLS (Transport Layer Security) encrypts the connection between browser and server; recognisable by HTTPS. TLS 1.2 and 1.3 are currently recommended, and older protocol versions should be disabled. TLS protects data in transit, not against vulnerabilities on the server itself. Configuring TLS and HTTPS Correctly →
Type juggling: Type juggling is the name for PHP's automatic type conversion, for example in loose comparison with ==. As a result, values can count as equal that are not, which becomes dangerous in password or token checks. Protection comes from strict comparison with === and hash_equals() for secrets. Type Juggling in PHP: Loose Comparisons as a Security Risk →

U

upload_max_filesize: upload_max_filesize limits the size of a single uploaded file; the default is 2 MB. The value must be smaller than post_max_size, because the file is part of the POST request. Overly generous values enlarge the attack surface without benefit. Sensibly Limiting post_max_size and upload_max_filesize →
.user.ini: .user.ini files are per-directory PHP settings that PHP-FPM and CGI evaluate. They allow website operators without server access to change individual values, but only those that PHP permits for this. According to php.net, security-relevant settings such as session.upload_progress.enabled=0 against PHP2Shell should not be set via .user.ini. The php.ini Explained: Structure, Levels and Precedence →

V

VdS 10000: VdS 10000 is a guideline from VdS Schadenverhütung (a German loss-prevention institute) for information security in small and medium-sized enterprises. It is leaner than ISO 27001 and tailored to the capabilities of SMEs. Certification against it is possible. VdS 10000: Information Security for Small and Mid-Sized Businesses →
Virtual patching: Virtual patching blocks attacks on a known vulnerability in front of the application, usually with a WAF, without changing the vulnerable code. It buys time until the real update is possible. With PHP2Shell, Cloudflare for example warns that rules based on request data alone are not sufficient; the update remains mandatory. WAF and Virtual Patching for PHP →
vServer: A vServer (virtual server) is a virtual machine on shared hardware, with its own operating system and usually root access. The same applies for security as for the root server: updates and hardening are the customer's business. Many vServers run with preinstalled panels such as Plesk. Securing Your Own Root Server and vServer →

W

WAF: A WAF (web application firewall) checks HTTP requests in front of the application and blocks known attack patterns. It can run as a cloud service, as a proxy or as a web server module. It buys time but does not replace an update, and it is bypassed if the server is also reachable directly. WAF and Virtual Patching for PHP →
Warning level: The BSI classifies the threat situation in security warnings into levels that are also colour-coded. Level 3 (orange) stands for a business-critical situation with possible massive impairment of normal operations. For PHP2Shell, warning level 3 / orange applies. BSI Warning Level Orange: What the Rating Means →
Webshell: A webshell is a script that attackers place on a web server to control it remotely via the browser. It is often small, obfuscated and hidden in upload or cache folders. A webshell remains even after a PHP or CMS update and has to be searched for deliberately. Detecting and removing webshells →

X

XSS: XSS (cross-site scripting) means that foreign JavaScript is executed in other visitors' browsers via a website. This allows sessions to be hijacked or form input to be read. Protection comes from consistently encoding all output and a content security policy. Preventing XSS in PHP: defending against cross-site scripting →
XXE: XXE (XML external entities) exploits the fact that XML parsers can load external references in documents. This can, under certain circumstances, allow files to be read from the server or internal requests to be triggered. Protection comes from disabling the loading of external entities when processing untrusted XML data. Preventing XML External Entities (XXE) in PHP →

Z

ZAC: The Central Contact Points for Cybercrime (ZAC) of the German police are specialised contact points for companies and authorities that have become victims of a cyber attack. They exist in all German federal states and at the Federal Criminal Police Office (BKA). They take criminal complaints and advise on how to proceed. Filing a Criminal Complaint: Central Contact Points for Cybercrime →
Zend Engine: The Zend Engine is the core of the PHP interpreter. It translates PHP code into internal instructions (opcodes), executes them and manages memory. Flaws in the Zend Engine affect every PHP application and can only be fixed by a PHP update. The Zend Engine: The Heart of PHP →
Zero-day: A zero-day is a vulnerability that is exploited or publicly known before the vendor provides a patch. Operators then have zero days of lead time. Until the patch, only interim measures, isolation and monitoring help. The Time Window Between Patch and Attack →

Immediate contact

Every hour counts. Write to us now.

Briefly describe your system, PHP version and observation. We will get back to you, clarify the situation and work remotely until the incident is closed and documented.

WhatsApp emergency Call