CVE-2026-80668 on CentOS 7: Fixed Kernel for EL7
by Danila Vershinin, November 7, 2026
CVE-2026-80668 is a remote Linux kernel use-after-free in netfilter conntrack, CVSS 9.8. The stock CentOS 7 kernel is affected with no update. The fix is kernel-lt 6.18.62, free for any use.
Read More...Remi PHP Extended Support: Security Updates for CentOS 7
by Danila Vershinin, November 6, 2026
Remi stopped building PHP for CentOS 7 in June 2024. Here is how to keep your existing Remi PHP receiving security updates in place, and how that compares with TuxCare and Cybertrust extended support.
Read More...Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli
by Danila Vershinin, November 4, 2026
CVE-2026-111497 (HTTP2Shell) is a Brotli decoder bug. ngx_brotli only compresses and is not affected; on CentOS 7 and Amazon Linux 2 the fix is libbrotli 1.2.1 from GetPageSpeed, since EPEL 7 is archived at 1.0.9.
Read More...PHP2Shell on AlmaLinux, Rocky Linux and RHEL 8/9/10: Check and Patch
by Danila Vershinin,
PHP2Shell (CVE-2026-109618, CVE-2026-109619) is fixed in every AlmaLinux 8, 9 and 10 PHP stream. How to check your build, the fixed version per stream, and what Rocky Linux and RHEL users on retired streams should do.
Read More...PHP2Shell on CentOS 6: Patched PHP 5.3, 7.0 and 7.1
by Danila Vershinin, November 2, 2026
PHP2Shell (CVE-2026-109618, CVE-2026-109619) has no distribution or upstream fix on CentOS 6. Here is the in-place fix for the stock PHP 5.3 and Remi PHP 7.0 and 7.1, free to install.
Read More...CVE-2026-98432 on CentOS 7: Fix for ELRepo Kernels
by Danila Vershinin, November 1, 2026
CVE-2026-98432 is a remote Linux kernel use-after-free. CentOS 7’s stock kernel is not affected; ELRepo’s kernel-lt and kernel-ml are and get no fix. The fix is kernel-lt 6.18.60, free for any use.
Read More...TCP BBR vs Cubic: Fix Slow Transfers on Lossy Links
by Danila Vershinin, October 31, 2026
Cubic collapsed to 20 KB/s on a lossy long-haul path. BBR on the sender made it up to 50x faster, and a relay around the bad hop made it fast every time. How to diagnose with ss and mtr, enable BBR (even on a live socket), and get it on CentOS 7.
Read More...PHP 8.2 End of Life (December 31, 2026): What Are Your Options?
by Danila Vershinin,
PHP 8.2 reaches end of life on December 31, 2026: no more upstream security releases. Upgrade paths for current distros, and patched 8.2 packages for CentOS 7 / RHEL 7 and Ubuntu 20.04 where updates already stopped.
Read More...Your CLAUDE.md Is Public: Block AI Agent Files in NGINX
by Danila Vershinin, October 29, 2026
AI coding agents leave CLAUDE.md, AGENTS.md and prompt files in your web root. Block them in NGINX and auto-ban the scanners that probe for them.
Read More...PHP2Shell Mitigation in NGINX: What It Can and Can’t Block
by Danila Vershinin,
Can NGINX mitigate PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Partly. Tested configs for blocking multipart and filtering uploads with ModSecurity, and why only patched PHP fixes it.
Read More...