Centillex Aegis — the page behind the shield
This page is served by PHP 8.3.35 — an unpatched, affected release, in its stock configuration — reachable from the internet only through Centillex Aegis, the edge-hardening proxy for PHP. It stays on the affected version on purpose: the defense you can verify is the defense you can trust.
This origin, right now
- PHP version (affected release)
- 8.3.35
- Server API
- apache2handler
- session.upload_progress (left ON)
- 1
- memory_limit / post_max_size
- 128M / 8M
- Your request
- GET · /
- Parsed by PHP this request
- 0 POST fields, 0 file controls
- Server time
- Thu, 22 Oct 2026 12:20:30 GMT
What the public toolkit does here
| Attack (ikow/php2shell-poc) | Result at the edge |
|---|---|
| Chain A — session injection + LFI | Blocked 403 at the planting request |
| Chain B — var_destroy UAF (unserialize() input) | Blocked 403; serialized-PHP grammar refused at the edge |
| Chain C — handler mismatch → __destruct | Blocked 403; no gadget is ever planted |
| Chain D — OOM corruption trigger | Blocked 413 before the origin sees a byte |
| Chain E — session-decode OOM chain | Blocked 403 at every wire-crossing step |
Run the toolkit against this page with its own scripts — every probe is refused with Request blocked by Centillex Aegis, and repeated attempts trip the per-IP strike ban (429).
Honest scope
Aegis is exposure reduction, not a patch. Updating PHP
remains the only complete fix, and this site keeps the affected release
running deliberately, behind limits that are enforced before PHP parses
anything. Serialized-PHP payloads are refused at the edge wherever
unserialize-visible bytes can travel, but the edge cannot see through
application-level encoding (a base64 or encrypted cookie fed to
unserialize()) — that part remains origin governance.
Run Aegis in front of your PHP
Public image — ghcr.io/centillex/aegis.
One container, one required variable: point it at your PHP origin and put
it in the request path.
docker run -d --name aegis \ -p 8080:8080 \ -e UPSTREAM=http://your-php-origin:80 \ ghcr.io/centillex/aegis
LISTEN defaults to
0.0.0.0:8080. Firewall the origin so only
Aegis can reach it — an edge that can be bypassed protects nothing.
Every limit is tunable; report-only mode (POLICY_MODE=report)
tunes them safely on live traffic.Questions, receipts, or a private walkthrough —
hello@centillex.com