At OPSSHIELD, maintaining the highest security standard for our clients’ servers is our top priority. Following the recent public disclosure of critical PHP vulnerabilities, our team immediately took comprehensive action across cPGuard and cPGuardX to protect hosted websites, isolate threat vectors, and update system components.

Here is a detailed breakdown of the mitigation steps, WAF protections, and updates applied across our ecosystem.

1. Instant Virtual Patching via WAF Rules

Immediately upon the public disclosure of the vulnerability details, our security team deployed specialized Web Application Firewall (WAF) rules to inspect incoming request payloads and block exploitation attempts targeting vulnerable PHP installations.

The following cPGuard WAF rules actively protect hosted websites against these attack vectors:

• 501501
• 501502
• 501503
• 501504
• 400015

These rules inspect incoming multipart payload structures and request headers in real time, automatically dropping malicious traffic before it reaches the target application or PHP parser.

2. Hardening Internal cPGuard Runtime Environment

To ensure our security stack remains completely secure and unaffected, we immediately applied runtime configuration patches to cPGuard’s internal PHP environment as a proactive defense mechanism.

Following the initial configuration hardening, we upgraded cPGuard’s internal PHP runtime to the latest actively supported version.

3. Rapid Patching & Backporting for cPGuardX

For cPGuardX environments, our automated build pipeline and engineering teams moved rapidly to secure all PHP instances:

Swift Build & Patch Deployment: All managed PHP binaries compiled by cPGuardX were patched within hours of the official code fixes being made public.

Legacy Branch Backporting: Recognizing that many legacy production environments rely on older PHP releases, we backported the security fixes directly to PHP 8.1 and PHP 7.4.

LiteSpeed Web Server (LSWS) PHP Fixes: We integrated and applied the official fixes across LSWS PHP builds and restarted all relevant instances.

server-wide—completing the entire patching process within 5 hours of the upstream release

Recommended Action for Server Administrators

While virtual patching through cPGuard WAF rules and cPGuardX updates provides robust perimeter security, upgrading target PHP binaries to official vendor-patched releases remains the ultimate resolution.

We strongly advise all server administrators and web hosts to:

Update system PHP packages across all hosted accounts to the latest patched releases provided by your OS distribution or control panel (cPanel, DirectAdmin, Plesk, etc.).

Restart relevant web server and PHP-FPM / LSAPI worker processes to ensure running instances load the updated libraries.

Stay Protected

If your server runs cPGuard, your WAF rules are automatically updated to block these threats. You can review all release notes and technical logs on our official changelog.

If you have questions or require assistance verifying your configuration, please reach out to our support team at support.opsshield.com.

PHP2Shell Mitigation: Disable Session Upload Progress and Virtual Patching with cPGuard

Server administrators are strongly advised to disable PHP’s session upload progress feature as an immediate mitigation measure and prepare to apply official PHP vendor patches. This configuration update should be pushed across all active PHP versions and execution handlers running on your web servers.

Understanding the Risk

The PHP development team recently issued security advisories detailing critical vulnerabilities (CVSS v4.0 rated 9.2) tracked under CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell.

Independent security research indicates that PHP’s session.upload_progress implementation serves as a primary vector for exploitation. While disabling this feature reduces the exposure surface associated with session-based file upload handlers, it should be treated as an immediate temporary mitigation alongside proactive Web Application Firewall (WAF) filtering.

Step 1: Disable Session Upload Progress Across All PHP Versions

To mitigate the attack surface at the runtime level, ensure that session.upload_progress.enabled is explicitly turned off in your primary php.ini directives.

Add or verify the following configuration line:

session.upload_progress.enabled = Off

Global Configuration: Apply session.upload_progress.enabled = Off in the master php.ini files for every installed PHP binary version.

Runtime Overrides: Inspect pool configurations (php-fpm.conf, www.conf, or custom per-user INI files) to ensure this value is not explicitly re-enabled.

Restart Services: Reload/restart PHP-FPM, LiteSpeed, or Apache services so running worker processes adopt the updated configuration immediately:

Will File Uploads Still Function?

Yes. Standard file uploads across CMS platforms (WordPress, Joomla, Magento, etc.) and custom applications will continue to operate normally. Disabling this setting only turns off PHP’s built-in progress tracking mechanism. Applications relying specifically on PHP_SESSION_UPLOAD_PROGRESS to render real-time upload progress bars may lose that specific tracking UI.

Step 2: Layered Defense with cPGuard WAF

To provide an extra layer of perimeter defense, the cPGuard WAF engine includes rules tailored to inspect incoming multipart HTTP payload headers and block requests carrying malicious vectors before they hit the PHP parser.

Automatic Rule Updates: The new rule will reach all servers autotmatically and you can force the rule update by disabling-enabling WAF module. The latest rule set automatically analyzes incoming request bodies for suspicious upload-progress parameters.

Proactive LFD Monitoring: IP addresses attempting to exploit unpatched PHP endpoints will be flagged and automatically blocked by cPGuard’s Login Failure Daemon (LFD).

Step 3: Patch PHP Packages

While runtime mitigation and WAF rules significantly reduce your risk, virtual patching is not a permanent replacement for vendor security updates.

Monitor your OS package manager repositories (CloudLinux, AlmaLinux, RHEL, Ubuntu, or Debian) for patched PHP packages.

Upgrade all PHP instances as soon as official vendor updates are published.

Useful Links & References

Official PHP Release Announcement: https://www.php.net/archive/2026.php

External reference: https://blog.flatt.tech/entry/php2shell

External reference: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

More Options, Greater Value: Introducing Flexible cPGuard Pricing & Plans Built for Every Scale

At OPSSHIELD, our goal has always been to provide enterprise-grade web security that is both robust and accessible. As hosting environments evolve, server administrators need flexibility—paying only for what they actually use without sacrificing security features.

To better support every stage of your growth, we are introducing an updated plan structure with lower entry pricing and more options for right-sizing licenses as your hosting environment grows.

Important Notes for Our Clients:

• Effective Date: The new plan structure will go into effect on September 16, 2026.
• Existing Customers: All active subscriptions remain 100% untouched.
  Your current pricing and plan limits are fully grandfathered for your existing active services. They will retain their current pricing and license limits for as long as those subscriptions remain active.

What’s New?

We listened to your feedback. Many smaller hosting providers and admins needed an entry-level tier for lightweight VPS setups, while growing hosts wanted a dedicated step between mid-tier and unlimited limits.

To give you greater control over your security budget, we are introducing two brand-new plan tiers alongside our restructured options for new licenses:

Why This Delivers More Value

• Unlocks Access at Just $3/Month: Running smaller VPS instances? You no longer have to pay for capacity you don’t need. The new 10-User Starter Plan lowers the entry point to just $3/month with annual billing.
• Granular Scaling: Previously, crossing the 50-user threshold meant jumping directly to the Unlimited plan. The new 250-User Business Plan bridges that gap, giving growing hosting providers a more cost-effective option before they need an Unlimited license.
• Legacy Rates Available with Annual Billing: For the 50-User and Unlimited plans, annual billing retains the same effective monthly rates as our previous pricing—$6/month for 50 Users and $11/month for Unlimited. This gives new licenses the option to maintain those established rates with an annual commitment.

Right-Sizing Security for Your Fleet

With more plan options and lower entry pricing, new deployments can choose the license that best matches the size of their server and scale as they grow.

Importantly, there are no feature compromises between tiers. Every cPGuard plan includes the same core security features, updates, and support—the only difference is the number of server users covered.

Built to Grow, Priced to Stay Accessible

Since its launch, cPGuard has continuously evolved alongside the needs of web hosting providers and server administrators. What began as a focused server security solution has grown into a comprehensive security suite, with advanced malware detection and automated cleanup, WAF integration, intelligent firewall protection, and continued developments such as our native LFD integration.

As cPGuard has expanded, our core philosophy has remained the same: powerful server security should remain accessible and cost-effective at every scale. Rather than simply increasing prices as the platform grows, our new plan structure gives customers more choice—allowing smaller deployments to start at a lower cost while providing clear, affordable steps as their infrastructure grows.

Whether you’re securing a small VPS or hundreds of hosting servers, you get the same cPGuard security features, updates, and support—the plan you choose simply reflects the size of the server you’re protecting.

For all existing active subscriptions, your current pricing and plan limits remain unchanged.

Next-Gen Brute-Force Protection: Why You Should Switch from Fail2ban to cPGuard LFD

Securing your servers against relentless brute-force and web-based attacks requires agility, speed, and deep integration. For years, Fail2ban has been the standard tool for monitoring logs and banning malicious IPs in cPGuard. However, as modern attack vectors evolve, standard tools can sometimes struggle under heavy load, consuming precious CPU and memory.

To solve this, we are thrilled to introduce CPG LFD—our brand-new, ultra-lightweight Login Failure Daemon designed specifically for cPGuard.

If you are currently running Fail2ban, here is why switching to cpglfd is the single best upgrade you can make for your server’s performance and security today.

What is cPGuard LFD ( cpglfd)?

cPGuard LFD is a proprietary, high-performance log-parsing and login-failure daemon built from the ground up to replace Fail2ban within the cPGuard ecosystem. It monitors system and application logs in real-time, detects malicious authentication attempts, and instantly mitigates brute-force attacks before they can overwhelm your applications, websites or control panels.

Why cpglfd eclipses traditional Fail2ban

While Fail2ban is a versatile tool, it is built as a generic solution. cpglfd, on the other hand, is purpose-built for web hosting environments running cPGuard.

1. Ultra-Lightweight & High Efficiency

Fail2ban can become resource-heavy, especially on busy servers with massive log files. It frequently spikes CPU usage when parsing logs under a heavy distributed brute-force attack. cpglfd has been engineered for maximum efficiency, boasting a microscopic resource footprint. It processes logs with minimal overhead, leaving your RAM and CPU free to serve your actual website traffic.

2. Native cPGuard firewall integration

Fail2ban relies on generic external wrappers to manipulate system firewalls, which can occasionally cause synchronization delays. The cpglfd features native, deep integration with the cPGuard firewall layer. When an IP is flagged for abuse, the block is injected directly and seamlessly into your cPGuard firewall rules instantly, ensuring zero-lag mitigation. When you enable Captcha protection in the firewall settings, the cpglfd block enabled Captcha verification for the blocked IPs and let the genuine users to unblock themselves.

3. Smarter web & Brute-Force defense

Because it is deeply embedded into our ecosystem, cpglfd possesses a contextual understanding of web attacks that generic tools lack. It works hand-in-hand with cPGuard’s existing threat intelligence, allowing it to differentiate between a genuinely malicious botnet and an accidental user typo much more effectively.

4. No need for third-party dependencies

Since cpglfd is developed inhouse, it does not need to install third-party packages and maintaining them.

The Verdict: cpglfd is the new recommended standard

To ensure our customers get the absolute best performance out of their infrastructure, cPGuard now officially recommends cpglfd over Fail2ban for all deployments.

By making the switch, you immediately unlock:

• Better server response times under attack.
• Drastically reduced CPU and memory overhead.
• Tighter, unified security orchestration.

How to Switch

Transitioning from Fail2ban to the new LFD module is completely seamless. We have automated the process to ensure your server remains fully protected during the swap.

You can enable the new cpglfd module directly through your cPGuard’s Firewall settings page

Select server > Go to Firewall settings >  Turn on Intrusion Defence (lfd)

Fail2ban will be automatically turned off when lfd is turned ON

and using CLI, you can run the following command

Announcing cPGuard Firewall 5.83.00: Enhanced Performance with iptables & New Features

We are excited to announce a major update to the cPGuard system firewall. Since our initial NFT-based launch in late 2025, we have been listening closely to your feedback and monitoring performance across diverse environments.
In version 5.83.00, we are introducing a revamped firewall architecture designed for stability, speed, and better user control.

The Shift: Returning to iptables/ipset

When we first introduced the NFT-based firewall, the goal was to leverage modern netfilter tools for a lighter, faster experience. However, real-world deployments presented unexpected challenges, including:

• Stalled firewall rules and slow rule checks.
• Unexpected rule failures.
• Performance bottlenecks under heavy loads.

After extensive internal testing and consultation with our customers, we have decided to revamp the system using iptables/ipset as the primary provider. This ensures the reliability you expect from cPGuard, while still keeping nftables available as an option for those who prefer it.

What’s New in Version 5.83.00?

The latest version is more than just a provider shift; it includes several functional enhancements:

• Optimized Performance: The iptables-based system is significantly faster and maintains a low system load, even when managing tens of thousands of IP addresses.
• Advanced DoS Mitigation: New rules allow you to set connection limits per port/IP. The updated logic also resolves excessive logging issues during active attacks.
• IP & Country Ignore Lists: Entries in the ignore list will now bypass deny rules and the IPDB, ensuring your trusted connections are never interrupted.
• Flexible Providers: While iptables is now the default for new installations, you can switch between iptables and nftables at any time via the UI or CLI.

Introducing the New Grey List & Captcha Unlock

To reduce support tickets and improve the end-user experience, we’ve introduced a 24-hour Grey List.
If an IP is temporarily blocked, users can now use a Captcha-based unlock option to delist themselves (similar to CSF messenger).

Note: Currently available for cPanel and DirectAdmin, with support for more panels coming soon.

How to Switch to the iptables Firewall

To ensure stability, we are not enforcing the new iptables ruleset on existing installations automatically. If you wish to migrate your current server to the new firewall, you can do so via:

1. Command Line Interface (CLI): Run the following command:

2. App Portal: Navigate to Protection > Firewall and update your settings.

Looking Ahead: The New LFD Module

Our work doesn’t stop here. We are currently developing a new LFD (Log Failure Daemon) module to replace the existing Fail2ban-based monitoring. This new system will be:

• Lighter and Faster: Built specifically for the cPGuard ecosystem.
• Tightly Integrated: Allowing the Grey List to be fully utilized so genuine clients can easily unlock themselves after a block.

Stay tuned for these upcoming changes as we continue to evolve cPGuard to meet your security needs!