PHP Sentinel

PHP Sentinel

Overview

PHP Sentinel serves as a robust reverse proxy designed to safeguard PHP applications from parser-level exploits. It proficiently reroutes every HTTP request through a series of isolated canary PHP-FPM instances. In the event of any canary instance crashing due to an exploit, the request is promptly blocked before reaching the production environment, ensuring the integrity of the application.

This solution specifically aims to combat vulnerabilities such as CVE-2026-109619 (use-after-free in session upload progress) and a wide array of PHP SAPI parsing vulnerabilities, both known and unknown.

How It Operates

The architecture of PHP Sentinel is depicted below:

                          Client Request
                               │
                               ▼
                       ┌───────────────┐
                       │   Sentinel    │   Port 8080
                       │    Proxy      │   (Python / aiohttp)
                       └───────┬───────┘
                               │
              Fan out to ALL canaries in parallel
              ┌────────┬───────┼───────┬────────┐
              ▼        ▼       ▼       ▼        ▼
          ┌───────┐┌───────┐┌─────┐┌───────┐┌───────┐
          │PHP 8.4││PHP 8.3││ ... ││PHP 7.0││PHP 5.6│
          │Canary ││Canary ││     ││Canary ││Canary │
          └───┬───┘└───┬───┘└──┬──┘└───┬───┘└───┬───┘
              │        │       │       │        │
              └────────┴───────┼───────┴────────┘
                               │
                  ALL survived? ─► YES → Forward to production
                               └─► ANY died → Block (403)
                               │
                               ▼
                       ┌───────────────┐
                       │  Production   │
                       │   Backend     │
                       └───────────────┘

Each canary operates in complete isolation from others, having no access to databases, secrets, or external networks. Its primary function is to parse requests solely through PHP's SAPI code paths, effectively detecting specific exploits designed to target various PHP versions.

Security Features

Requests exceeding 32MB automatically bypass the canary system, as PHP parser exploits commonly trigger during the early stages of parsing headers and multipart structures. However, this behavior can be modified by setting SENTINEL_MAX_REPLAY_BODY=0 in the docker-compose.yml configuration file, which will ensure that larger requests are evaluated through the entire canary set, albeit with potential latency for substantial uploads.

Notable Features:

• Multi-Version Canary Array: Supports 11 PHP versions (5.6 to 8.4) running simultaneously.
• Admin API & Dashboard: Allows for real-time management of the canaries and provides comprehensive health and attack metrics.
• Zero False Negatives: The canary mimic production environments, ensuring any exploit that affects production also affects the canary instances.
• Block Logging: All blocked requests are logged in JSON lines format, including header and body previews.
• Per-Canary Metrics: Detailed tracking of errors, timeouts, and crashes for each PHP version.

Connecting PHP Sentinel to Your Application

PHP Sentinel can be easily integrated with existing PHP applications:

1. Option 1: Point PHP Sentinel at an existing PHP server by adjusting the SENTINEL_BACKEND_URL in the docker-compose.yml file to the real application address.
2. Option 2: Run the application inside the same Docker Compose stack by replacing the backend service with the application's own Docker container setup.

Testing Capabilities

PHP Sentinel includes built-in testing suites for both targeted attacks that assess canary robustness and stress tests with varied payloads to ensure high traffic resilience.

This solution offers a comprehensive response to modern PHP vulnerabilities, while maintaining operational efficiency and application integrity. Visit the repository for additional deployment instructions and configuration options.