Practical guides for managing Linux servers, control panels, cloud infrastructure, security, and email systems.
On the RHEL family the PHP2Shell fix depends on which module stream or repository supplies your PHP. How to find out, update with dnf or Remi, restart php-fpm and confirm the fix is in.
Read the article
How to patch the PHP2Shell flaws on a cPanel server: every ea-php and alt-php version, the services to restart, LiteSpeed and Imunify notes, and the changelog check that proves the fix.
Plesk servers run two kinds of PHP, the builds Plesk ships and the ones from the operating system. How to update both for PHP2Shell, restart FPM and confirm every handler is covered.
Ubuntu and Debian ship PHP2Shell fixes as backports, so php -v still shows the old number. The fixed versions, the commands to update and restart, and how to prove the fix is in.
Updating PHP stops new attacks but does not tell you whether someone got in earlier. A practical sweep of logs, new files, processes and scheduled jobs, plus when to rotate credentials.
PHP2Shell is a pair of critical PHP flaws that let an unauthenticated visitor run code on a web server. How to check if you are exposed, why php -v can mislead you, and the order to patch in.
When dnf refuses to update because it cannot download repository metadata, the cause is usually one dead repo, not AlmaLinux itself. How to find that repo and fix it without breaking updates.
A DirectAdmin licensing error locks you out of the panel, but each message has a different cause. How to read the log and fix lost license session, IP restrictions and blocked licensing traffic.
The error says the disk is full, but df says it is not. Here is the order we check things in on a live server: inodes first, then deleted-but-open files, tmpfs and reserved blocks.
A Windows Server that answers on port 3389 but throws An internal error has occurred is usually failing on its RDP certificate or security negotiation. A test-first approach to finding which.
When the key is right and SSH login still fails, the answer is on the server: permissions, SELinux labels, sshd rules and key types. How to check each, and how to recover a lockout.
A WordPress site that sends visitors to spam pages is almost always infected in a handful of predictable places. How to hunt for the malware on a cPanel server, and what to do before cleaning.
