PHP2Shell Mitigation in NGINX: What It Can and Can’t Block
Can NGINX mitigate PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Partly. Tested configs for blocking multipart and filtering uploads with ModSecurity, and why only patched PHP fixes it.
waf
Practical waf guides from the GetPageSpeed engineering team: configuration, performance tuning and security for production Linux servers.
5 articles
NGINX WAF Module: Lightweight Web Application Firewall
Install and configure the ngx_waf module to protect NGINX against SQL injection, XSS, malicious bots, and CC attacks. Includes IP blacklists, regex rules, rate…
Install ModSecurity NGINX: Complete WAF Guide
Complete guide to installing ModSecurity WAF with NGINX. Learn how to protect your web applications from SQL injection, XSS, and OWASP Top 10 vulnerabilities…
ModSecurity NGINX Rocky Linux 10: WAF Setup
Install ModSecurity WAF for NGINX on Rocky Linux 10 and AlmaLinux 10. Complete guide covering installation, OWASP Core Rule Set configuration, rule tuning, and…
How to install NGINX WAF module in Fedora Linux
How to easily set up WAF module protecting your NGINX powered websites in Fedora Linux. Install prebuilt NGINX WAF module.