How to secure an EOL server against PHP2Shell

As you may have seen in our announcements, all of our managed servers and shared servers were patched by Websavers staff as soon as patches became available. However, for those of you with a self-managed server without Plesk, patching the OS packages, like PHP, is up to the server manager.

One of our long-time VPS users was kind enough to provide a step-by-step guide to doing exactly that! They posted the steps on their Dev page here, but here’s an excerpt to see if it’s for you:

This guide details how to decouple the PHP runtime from your host operating system. By shifting execution into an isolated Docker container while keeping your native Apache web server handling SSL and routing, you protect your host OS from critical application-layer vulnerabilities (like PHP2Shell) and easily upgrade your PHP versions. This guide is useful if you are running an outdated host that cannot easily be updated or replaced. For example, Debian 11 only provides up to PHP 7.4 which has not received a patch for this issue. Obviously, the ideal solution would be to migrate away from an EOL release entirely, however this may not be feasible and leaving your web server vulnerable to this exploit is a very bad idea.

Source: https://dev.to/besworks/securing-an-eol-host-against-php2shell-p8e