Exultia Technologies Cybernetic Fortress Helm
EXULTIA
TECHNOLOGIES
← Back to CVE Catalog/UVI-2026-11-00000158

UVI-2026-11-00000158

CVSS 9.1 (CRITICAL)
Published: 11/4/2026

OpenPhish Zero-Day Phishing Portal Digest (2026-11-05): 300 Active Portals

Affected Packagesphp-common, php-cli, php-fpm
Supported Environmentsubuntu, debian, linux-mint, rocky, rhel, almalinux, oracle-linux, suse, alpine, arch, fedora, amazon-linux, kernel, gentoo, freebsd, openbsd, netbsd, macos, wolfi, nixos, void, photon, flatcar, talos, openwrt, openeuler, cloudlinux, kali, azure-linux, centos-stream, opensuse-leap, fedora-coreos, proxmox, truenas-scale, windows
Cryptographic ProvenanceSLSA Level 3 (Cosign OIDC Signed)
⚡ Autonomous Live Mitigation(Zero-Downtime • Sub-50ms Rollback)

Deploy this patch across production Linux or Windows Server fleets with pre-flight sentinels and instant rollback guarantee.

exultia.exe patch --vendor --os windows-server
Tier 1

Zero-Downtime Hot-Mitigation Script

No reboot or service downtime

Sinkhole 90 active phishing domains to 0.0.0.0 in /etc/hosts and local DNS resolver.

mkdir -p /etc/exultia/blocklists
printf "%b\n" "www.metamaskchromeextensionn.blogspot.com\nwww.sideaapliccacccionn.com\nindexxjjo.vercel.app\nwww.upgraded-dollop-omega.vercel.app\nquatangchoem.vercel.app\nsocial-lift-five.vercel.app\nwww.89237892.com\nloginmsftcheck.com\nwww.vaegryyde.com\nportail-mlcrosoft.fr\nsp13ct-torek-biz-furon-kalem.pages.dev\nmetumasckgnn.gitbook.io\nboadashboard-com.cercel.app\nroblox.ss\nsend-dt-bsc.vercel.app\ntokemie-cdn6-hk1.cfd\nmydpd.xzphm.top\nb6a2f96c.hyt65chn.pages.dev\nqsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\nmydpd.udovl.top\nmydpd.orauw.help\nmfacebookk.com.vn\nrb922.top\nwww.paypall-login.blogspot.com\nbusy-portion-128853.framer.app\nsunrisewebee.jimdofree.com\nqmdhr3b3wy.hdply.com\nsp31ct-tavaro-biz-nelzi-kumep.pages.dev\nlog.verified-access.com\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\nbtdh-0x8t6v-awl75-p8wm-vfx.pages.dev\nprimenord.vip\nviewfileshares.com\nwww.roblox.com.ss\nsaks.global.mamje.com\napp-download-ledger-live.pages.dev\nmakcollins.github.io\nhigbkr.vercel.app\nsp10ct-burem-biz8-zadel-kofin.pages.dev\ndata-in-project.dynv6.net\n21a1a1s2.pages.dev\namazon-section-opal.vercel.app\nfinance-tracker-4ay.pages.dev\nsignbolemail.com\n4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\ntdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\nqtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\nwww.roblox.ly\nlpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev" > /etc/exultia/blocklists/openphish-2026-11-05.domains
printf "%b\n" "address=/www.metamaskchromeextensionn.blogspot.com/0.0.0.0\naddress=/www.sideaapliccacccionn.com/0.0.0.0\naddress=/indexxjjo.vercel.app/0.0.0.0\naddress=/www.upgraded-dollop-omega.vercel.app/0.0.0.0\naddress=/quatangchoem.vercel.app/0.0.0.0\naddress=/social-lift-five.vercel.app/0.0.0.0\naddress=/www.89237892.com/0.0.0.0\naddress=/loginmsftcheck.com/0.0.0.0\naddress=/www.vaegryyde.com/0.0.0.0\naddress=/portail-mlcrosoft.fr/0.0.0.0\naddress=/sp13ct-torek-biz-furon-kalem.pages.dev/0.0.0.0\naddress=/metumasckgnn.gitbook.io/0.0.0.0\naddress=/boadashboard-com.cercel.app/0.0.0.0\naddress=/roblox.ss/0.0.0.0\naddress=/send-dt-bsc.vercel.app/0.0.0.0\naddress=/tokemie-cdn6-hk1.cfd/0.0.0.0\naddress=/mydpd.xzphm.top/0.0.0.0\naddress=/b6a2f96c.hyt65chn.pages.dev/0.0.0.0\naddress=/qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev/0.0.0.0\naddress=/mydpd.udovl.top/0.0.0.0\naddress=/mydpd.orauw.help/0.0.0.0\naddress=/mfacebookk.com.vn/0.0.0.0\naddress=/rb922.top/0.0.0.0\naddress=/www.paypall-login.blogspot.com/0.0.0.0\naddress=/busy-portion-128853.framer.app/0.0.0.0\naddress=/sunrisewebee.jimdofree.com/0.0.0.0\naddress=/qmdhr3b3wy.hdply.com/0.0.0.0\naddress=/sp31ct-tavaro-biz-nelzi-kumep.pages.dev/0.0.0.0\naddress=/log.verified-access.com/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/btdh-0x8t6v-awl75-p8wm-vfx.pages.dev/0.0.0.0\naddress=/primenord.vip/0.0.0.0\naddress=/viewfileshares.com/0.0.0.0\naddress=/www.roblox.com.ss/0.0.0.0\naddress=/saks.global.mamje.com/0.0.0.0\naddress=/app-download-ledger-live.pages.dev/0.0.0.0\naddress=/makcollins.github.io/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/sp10ct-burem-biz8-zadel-kofin.pages.dev/0.0.0.0\naddress=/data-in-project.dynv6.net/0.0.0.0\naddress=/21a1a1s2.pages.dev/0.0.0.0\naddress=/amazon-section-opal.vercel.app/0.0.0.0\naddress=/finance-tracker-4ay.pages.dev/0.0.0.0\naddress=/signbolemail.com/0.0.0.0\naddress=/4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev/0.0.0.0\naddress=/tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev/0.0.0.0\naddress=/qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev/0.0.0.0\naddress=/www.roblox.ly/0.0.0.0\naddress=/lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev/0.0.0.0\naddress=/6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-05.conf
touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-05/,/# END EXULTIA-OPENPHISH-2026-11-05/d' /etc/hosts 2>/dev/null || true
printf "# BEGIN EXULTIA-OPENPHISH-2026-11-05\n0.0.0.0 www.metamaskchromeextensionn.blogspot.com\n0.0.0.0 www.sideaapliccacccionn.com\n0.0.0.0 indexxjjo.vercel.app\n0.0.0.0 www.upgraded-dollop-omega.vercel.app\n0.0.0.0 quatangchoem.vercel.app\n0.0.0.0 social-lift-five.vercel.app\n0.0.0.0 www.89237892.com\n0.0.0.0 loginmsftcheck.com\n0.0.0.0 www.vaegryyde.com\n0.0.0.0 portail-mlcrosoft.fr\n0.0.0.0 sp13ct-torek-biz-furon-kalem.pages.dev\n0.0.0.0 metumasckgnn.gitbook.io\n0.0.0.0 boadashboard-com.cercel.app\n0.0.0.0 roblox.ss\n0.0.0.0 send-dt-bsc.vercel.app\n0.0.0.0 tokemie-cdn6-hk1.cfd\n0.0.0.0 mydpd.xzphm.top\n0.0.0.0 b6a2f96c.hyt65chn.pages.dev\n0.0.0.0 qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\n0.0.0.0 mydpd.udovl.top\n0.0.0.0 mydpd.orauw.help\n0.0.0.0 mfacebookk.com.vn\n0.0.0.0 rb922.top\n0.0.0.0 www.paypall-login.blogspot.com\n0.0.0.0 busy-portion-128853.framer.app\n0.0.0.0 sunrisewebee.jimdofree.com\n0.0.0.0 qmdhr3b3wy.hdply.com\n0.0.0.0 sp31ct-tavaro-biz-nelzi-kumep.pages.dev\n0.0.0.0 log.verified-access.com\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 btdh-0x8t6v-awl75-p8wm-vfx.pages.dev\n0.0.0.0 primenord.vip\n0.0.0.0 viewfileshares.com\n0.0.0.0 www.roblox.com.ss\n0.0.0.0 saks.global.mamje.com\n0.0.0.0 app-download-ledger-live.pages.dev\n0.0.0.0 makcollins.github.io\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 sp10ct-burem-biz8-zadel-kofin.pages.dev\n0.0.0.0 data-in-project.dynv6.net\n0.0.0.0 21a1a1s2.pages.dev\n0.0.0.0 amazon-section-opal.vercel.app\n0.0.0.0 finance-tracker-4ay.pages.dev\n0.0.0.0 signbolemail.com\n0.0.0.0 4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\n0.0.0.0 tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\n0.0.0.0 qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\n0.0.0.0 www.roblox.ly\n0.0.0.0 lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n0.0.0.0 6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev\n# END EXULTIA-OPENPHISH-2026-11-05\n" >> /etc/hosts
🔍 Verification Sentinel Probe:
test -s /etc/exultia/blocklists/openphish-2026-11-05.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-05" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts
⏪ Sub-50ms Deterministic Rollback:
sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-05/,/# END EXULTIA-OPENPHISH-2026-11-05/d' /etc/hosts 2>/dev/null || true; rm -f /etc/exultia/blocklists/openphish-2026-11-05.domains /etc/exultia/blocklists/dns-sinkhole-2026-11-05.conf
Tier 3

Serialized 10% Canary Ansible Playbook

Fleet configuration management

Hardened Ansible playbook with staged canary progression (serial: 10%), configuration validation, and handler reload.

---
- name: Exultia Validated Fix - UVI-2026-11-00000158 (DNS Resolver & Host Sinkhole (/etc/hosts / dnsmasq))
  hosts: all
  become: yes
  serial: "10%"
  tasks:
    - name: Apply Validated Fix (EXPR-PERIMETER-DNS-SINKHOLE)
      ansible.builtin.shell: |
        mkdir -p /etc/exultia/blocklists
        printf "%b\n" "www.metamaskchromeextensionn.blogspot.com\nwww.sideaapliccacccionn.com\nindexxjjo.vercel.app\nwww.upgraded-dollop-omega.vercel.app\nquatangchoem.vercel.app\nsocial-lift-five.vercel.app\nwww.89237892.com\nloginmsftcheck.com\nwww.vaegryyde.com\nportail-mlcrosoft.fr\nsp13ct-torek-biz-furon-kalem.pages.dev\nmetumasckgnn.gitbook.io\nboadashboard-com.cercel.app\nroblox.ss\nsend-dt-bsc.vercel.app\ntokemie-cdn6-hk1.cfd\nmydpd.xzphm.top\nb6a2f96c.hyt65chn.pages.dev\nqsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\nmydpd.udovl.top\nmydpd.orauw.help\nmfacebookk.com.vn\nrb922.top\nwww.paypall-login.blogspot.com\nbusy-portion-128853.framer.app\nsunrisewebee.jimdofree.com\nqmdhr3b3wy.hdply.com\nsp31ct-tavaro-biz-nelzi-kumep.pages.dev\nlog.verified-access.com\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\nbtdh-0x8t6v-awl75-p8wm-vfx.pages.dev\nprimenord.vip\nviewfileshares.com\nwww.roblox.com.ss\nsaks.global.mamje.com\napp-download-ledger-live.pages.dev\nmakcollins.github.io\nhigbkr.vercel.app\nsp10ct-burem-biz8-zadel-kofin.pages.dev\ndata-in-project.dynv6.net\n21a1a1s2.pages.dev\namazon-section-opal.vercel.app\nfinance-tracker-4ay.pages.dev\nsignbolemail.com\n4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\ntdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\nqtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\nwww.roblox.ly\nlpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev" > /etc/exultia/blocklists/openphish-2026-11-05.domains
        printf "%b\n" "address=/www.metamaskchromeextensionn.blogspot.com/0.0.0.0\naddress=/www.sideaapliccacccionn.com/0.0.0.0\naddress=/indexxjjo.vercel.app/0.0.0.0\naddress=/www.upgraded-dollop-omega.vercel.app/0.0.0.0\naddress=/quatangchoem.vercel.app/0.0.0.0\naddress=/social-lift-five.vercel.app/0.0.0.0\naddress=/www.89237892.com/0.0.0.0\naddress=/loginmsftcheck.com/0.0.0.0\naddress=/www.vaegryyde.com/0.0.0.0\naddress=/portail-mlcrosoft.fr/0.0.0.0\naddress=/sp13ct-torek-biz-furon-kalem.pages.dev/0.0.0.0\naddress=/metumasckgnn.gitbook.io/0.0.0.0\naddress=/boadashboard-com.cercel.app/0.0.0.0\naddress=/roblox.ss/0.0.0.0\naddress=/send-dt-bsc.vercel.app/0.0.0.0\naddress=/tokemie-cdn6-hk1.cfd/0.0.0.0\naddress=/mydpd.xzphm.top/0.0.0.0\naddress=/b6a2f96c.hyt65chn.pages.dev/0.0.0.0\naddress=/qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev/0.0.0.0\naddress=/mydpd.udovl.top/0.0.0.0\naddress=/mydpd.orauw.help/0.0.0.0\naddress=/mfacebookk.com.vn/0.0.0.0\naddress=/rb922.top/0.0.0.0\naddress=/www.paypall-login.blogspot.com/0.0.0.0\naddress=/busy-portion-128853.framer.app/0.0.0.0\naddress=/sunrisewebee.jimdofree.com/0.0.0.0\naddress=/qmdhr3b3wy.hdply.com/0.0.0.0\naddress=/sp31ct-tavaro-biz-nelzi-kumep.pages.dev/0.0.0.0\naddress=/log.verified-access.com/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/btdh-0x8t6v-awl75-p8wm-vfx.pages.dev/0.0.0.0\naddress=/primenord.vip/0.0.0.0\naddress=/viewfileshares.com/0.0.0.0\naddress=/www.roblox.com.ss/0.0.0.0\naddress=/saks.global.mamje.com/0.0.0.0\naddress=/app-download-ledger-live.pages.dev/0.0.0.0\naddress=/makcollins.github.io/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/sp10ct-burem-biz8-zadel-kofin.pages.dev/0.0.0.0\naddress=/data-in-project.dynv6.net/0.0.0.0\naddress=/21a1a1s2.pages.dev/0.0.0.0\naddress=/amazon-section-opal.vercel.app/0.0.0.0\naddress=/finance-tracker-4ay.pages.dev/0.0.0.0\naddress=/signbolemail.com/0.0.0.0\naddress=/4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev/0.0.0.0\naddress=/tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev/0.0.0.0\naddress=/qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev/0.0.0.0\naddress=/www.roblox.ly/0.0.0.0\naddress=/lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev/0.0.0.0\naddress=/6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-05.conf
        touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-05/,/# END EXULTIA-OPENPHISH-2026-11-05/d' /etc/hosts 2>/dev/null || true
        printf "# BEGIN EXULTIA-OPENPHISH-2026-11-05\n0.0.0.0 www.metamaskchromeextensionn.blogspot.com\n0.0.0.0 www.sideaapliccacccionn.com\n0.0.0.0 indexxjjo.vercel.app\n0.0.0.0 www.upgraded-dollop-omega.vercel.app\n0.0.0.0 quatangchoem.vercel.app\n0.0.0.0 social-lift-five.vercel.app\n0.0.0.0 www.89237892.com\n0.0.0.0 loginmsftcheck.com\n0.0.0.0 www.vaegryyde.com\n0.0.0.0 portail-mlcrosoft.fr\n0.0.0.0 sp13ct-torek-biz-furon-kalem.pages.dev\n0.0.0.0 metumasckgnn.gitbook.io\n0.0.0.0 boadashboard-com.cercel.app\n0.0.0.0 roblox.ss\n0.0.0.0 send-dt-bsc.vercel.app\n0.0.0.0 tokemie-cdn6-hk1.cfd\n0.0.0.0 mydpd.xzphm.top\n0.0.0.0 b6a2f96c.hyt65chn.pages.dev\n0.0.0.0 qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\n0.0.0.0 mydpd.udovl.top\n0.0.0.0 mydpd.orauw.help\n0.0.0.0 mfacebookk.com.vn\n0.0.0.0 rb922.top\n0.0.0.0 www.paypall-login.blogspot.com\n0.0.0.0 busy-portion-128853.framer.app\n0.0.0.0 sunrisewebee.jimdofree.com\n0.0.0.0 qmdhr3b3wy.hdply.com\n0.0.0.0 sp31ct-tavaro-biz-nelzi-kumep.pages.dev\n0.0.0.0 log.verified-access.com\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 btdh-0x8t6v-awl75-p8wm-vfx.pages.dev\n0.0.0.0 primenord.vip\n0.0.0.0 viewfileshares.com\n0.0.0.0 www.roblox.com.ss\n0.0.0.0 saks.global.mamje.com\n0.0.0.0 app-download-ledger-live.pages.dev\n0.0.0.0 makcollins.github.io\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 sp10ct-burem-biz8-zadel-kofin.pages.dev\n0.0.0.0 data-in-project.dynv6.net\n0.0.0.0 21a1a1s2.pages.dev\n0.0.0.0 amazon-section-opal.vercel.app\n0.0.0.0 finance-tracker-4ay.pages.dev\n0.0.0.0 signbolemail.com\n0.0.0.0 4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\n0.0.0.0 tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\n0.0.0.0 qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\n0.0.0.0 www.roblox.ly\n0.0.0.0 lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n0.0.0.0 6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev\n# END EXULTIA-OPENPHISH-2026-11-05\n" >> /etc/hosts
      args:
        executable: /bin/sh
      register: kinetic_exec
      failed_when: kinetic_exec.rc != 0

    - name: Verify Post-Fix Gate
      ansible.builtin.shell: "test -s /etc/exultia/blocklists/openphish-2026-11-05.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-05" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts"
      changed_when: false
Tier 2

Vendor OS Package Upgrade Commands

Native package manager reconciliation
ubuntuDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
debianDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
kaliDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
linux-mintDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
proxmoxDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
truenas-scaleDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
rockydnf upgrade -y php-common php-cli php-fpm
rheldnf upgrade -y php-common php-cli php-fpm
almalinuxdnf upgrade -y php-common php-cli php-fpm
oracle-linuxdnf upgrade -y php-common php-cli php-fpm
cloudlinuxdnf upgrade -y php-common php-cli php-fpm
amazon-linuxdnf upgrade -y php-common php-cli php-fpm
fedoradnf upgrade -y php-common php-cli php-fpm
openeulerdnf upgrade -y php-common php-cli php-fpm
centos-streamdnf upgrade -y php-common php-cli php-fpm
azure-linuxtdnf update -y php-common php-cli php-fpm
photontdnf update -y php-common php-cli php-fpm
alpineapk update -q && apk upgrade --no-cache php83 php83-fpm
wolfiapk update -q && apk upgrade --no-cache php83 php83-fpm
susezypper --non-interactive update php-common php-cli php-fpm
opensuse-leapzypper --non-interactive update php-common php-cli php-fpm
archpacman -S --noconfirm php-common
gentooemerge --update --oneshot php-common
voidxbps-install -Su -y php-common
nixosnix-env -u php-common
openwrtopkg update && opkg upgrade php-common
freebsdpkg upgrade -y php-common
openbsdsyspatch
netbsdpkgin -y upgrade
fedora-coreosrpm-ostree upgrade
flatcarupdate_engine_client -check_for_update
talostalosctl upgrade-k8s
macossoftwareupdate -i -a

Full Standalone Hotfix Script

Complete, self-contained remediation script with privileges check, logging, pre-flight safety, and automatic rollback on verification failure:

#!/bin/sh
# ==============================================================================
# Exultia Surgical Remediation: UVI-2026-11-00000158
# Title: OpenPhish Zero-Day Phishing Portal Digest (2026-11-05): 300 Active Portals
# CVSS Score: 9.1 (CRITICAL) | CISA KEV: NO
# Provenance: [email protected] (Cosign OIDC Keyless) | SLSA Level 3
# Generated by Exultia Autonomous Remediation Engine (https://exultia.tech/cve/UVI-2026-11-00000158)
# ==============================================================================
set -e

log() { echo "[Exultia] $(date +'%Y-%m-%d %H:%M:%S') $1"; }
err() { echo "[Exultia] ERROR: $1" >&2; exit 1; }

if [ "$(id -u)" -ne 0 ]; then
  err "Root privileges required. Run with sudo or as root."
fi

log "Initiating zero-downtime hot-mitigation for UVI-2026-11-00000158..."

# Apply mitigation commands
log "Executing: mkdir -p /etc/exultia/blocklists"
mkdir -p /etc/exultia/blocklists
log "Executing: printf \"%b\n\" \"www.metamaskchromeextensionn.blogspot.com\nwww.sideaapliccacccionn.com\nindexxjjo.vercel.app\nwww.upgraded-dollop-omega.vercel.app\nquatangchoem.vercel.app\nsocial-lift-five.vercel.app\nwww.89237892.com\nloginmsftcheck.com\nwww.vaegryyde.com\nportail-mlcrosoft.fr\nsp13ct-torek-biz-furon-kalem.pages.dev\nmetumasckgnn.gitbook.io\nboadashboard-com.cercel.app\nroblox.ss\nsend-dt-bsc.vercel.app\ntokemie-cdn6-hk1.cfd\nmydpd.xzphm.top\nb6a2f96c.hyt65chn.pages.dev\nqsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\nmydpd.udovl.top\nmydpd.orauw.help\nmfacebookk.com.vn\nrb922.top\nwww.paypall-login.blogspot.com\nbusy-portion-128853.framer.app\nsunrisewebee.jimdofree.com\nqmdhr3b3wy.hdply.com\nsp31ct-tavaro-biz-nelzi-kumep.pages.dev\nlog.verified-access.com\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\nbtdh-0x8t6v-awl75-p8wm-vfx.pages.dev\nprimenord.vip\nviewfileshares.com\nwww.roblox.com.ss\nsaks.global.mamje.com\napp-download-ledger-live.pages.dev\nmakcollins.github.io\nhigbkr.vercel.app\nsp10ct-burem-biz8-zadel-kofin.pages.dev\ndata-in-project.dynv6.net\n21a1a1s2.pages.dev\namazon-section-opal.vercel.app\nfinance-tracker-4ay.pages.dev\nsignbolemail.com\n4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\ntdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\nqtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\nwww.roblox.ly\nlpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev\" > /etc/exultia/blocklists/openphish-2026-11-05.domains"
printf "%b\n" "www.metamaskchromeextensionn.blogspot.com\nwww.sideaapliccacccionn.com\nindexxjjo.vercel.app\nwww.upgraded-dollop-omega.vercel.app\nquatangchoem.vercel.app\nsocial-lift-five.vercel.app\nwww.89237892.com\nloginmsftcheck.com\nwww.vaegryyde.com\nportail-mlcrosoft.fr\nsp13ct-torek-biz-furon-kalem.pages.dev\nmetumasckgnn.gitbook.io\nboadashboard-com.cercel.app\nroblox.ss\nsend-dt-bsc.vercel.app\ntokemie-cdn6-hk1.cfd\nmydpd.xzphm.top\nb6a2f96c.hyt65chn.pages.dev\nqsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\nmydpd.udovl.top\nmydpd.orauw.help\nmfacebookk.com.vn\nrb922.top\nwww.paypall-login.blogspot.com\nbusy-portion-128853.framer.app\nsunrisewebee.jimdofree.com\nqmdhr3b3wy.hdply.com\nsp31ct-tavaro-biz-nelzi-kumep.pages.dev\nlog.verified-access.com\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\nbtdh-0x8t6v-awl75-p8wm-vfx.pages.dev\nprimenord.vip\nviewfileshares.com\nwww.roblox.com.ss\nsaks.global.mamje.com\napp-download-ledger-live.pages.dev\nmakcollins.github.io\nhigbkr.vercel.app\nsp10ct-burem-biz8-zadel-kofin.pages.dev\ndata-in-project.dynv6.net\n21a1a1s2.pages.dev\namazon-section-opal.vercel.app\nfinance-tracker-4ay.pages.dev\nsignbolemail.com\n4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\ntdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\nqtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\nwww.roblox.ly\nlpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev" > /etc/exultia/blocklists/openphish-2026-11-05.domains
log "Executing: printf \"%b\n\" \"address=/www.metamaskchromeextensionn.blogspot.com/0.0.0.0\naddress=/www.sideaapliccacccionn.com/0.0.0.0\naddress=/indexxjjo.vercel.app/0.0.0.0\naddress=/www.upgraded-dollop-omega.vercel.app/0.0.0.0\naddress=/quatangchoem.vercel.app/0.0.0.0\naddress=/social-lift-five.vercel.app/0.0.0.0\naddress=/www.89237892.com/0.0.0.0\naddress=/loginmsftcheck.com/0.0.0.0\naddress=/www.vaegryyde.com/0.0.0.0\naddress=/portail-mlcrosoft.fr/0.0.0.0\naddress=/sp13ct-torek-biz-furon-kalem.pages.dev/0.0.0.0\naddress=/metumasckgnn.gitbook.io/0.0.0.0\naddress=/boadashboard-com.cercel.app/0.0.0.0\naddress=/roblox.ss/0.0.0.0\naddress=/send-dt-bsc.vercel.app/0.0.0.0\naddress=/tokemie-cdn6-hk1.cfd/0.0.0.0\naddress=/mydpd.xzphm.top/0.0.0.0\naddress=/b6a2f96c.hyt65chn.pages.dev/0.0.0.0\naddress=/qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev/0.0.0.0\naddress=/mydpd.udovl.top/0.0.0.0\naddress=/mydpd.orauw.help/0.0.0.0\naddress=/mfacebookk.com.vn/0.0.0.0\naddress=/rb922.top/0.0.0.0\naddress=/www.paypall-login.blogspot.com/0.0.0.0\naddress=/busy-portion-128853.framer.app/0.0.0.0\naddress=/sunrisewebee.jimdofree.com/0.0.0.0\naddress=/qmdhr3b3wy.hdply.com/0.0.0.0\naddress=/sp31ct-tavaro-biz-nelzi-kumep.pages.dev/0.0.0.0\naddress=/log.verified-access.com/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/btdh-0x8t6v-awl75-p8wm-vfx.pages.dev/0.0.0.0\naddress=/primenord.vip/0.0.0.0\naddress=/viewfileshares.com/0.0.0.0\naddress=/www.roblox.com.ss/0.0.0.0\naddress=/saks.global.mamje.com/0.0.0.0\naddress=/app-download-ledger-live.pages.dev/0.0.0.0\naddress=/makcollins.github.io/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/sp10ct-burem-biz8-zadel-kofin.pages.dev/0.0.0.0\naddress=/data-in-project.dynv6.net/0.0.0.0\naddress=/21a1a1s2.pages.dev/0.0.0.0\naddress=/amazon-section-opal.vercel.app/0.0.0.0\naddress=/finance-tracker-4ay.pages.dev/0.0.0.0\naddress=/signbolemail.com/0.0.0.0\naddress=/4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev/0.0.0.0\naddress=/tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev/0.0.0.0\naddress=/qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev/0.0.0.0\naddress=/www.roblox.ly/0.0.0.0\naddress=/lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev/0.0.0.0\naddress=/6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev/0.0.0.0\" > /etc/exultia/blocklists/dns-sinkhole-2026-11-05.conf"
printf "%b\n" "address=/www.metamaskchromeextensionn.blogspot.com/0.0.0.0\naddress=/www.sideaapliccacccionn.com/0.0.0.0\naddress=/indexxjjo.vercel.app/0.0.0.0\naddress=/www.upgraded-dollop-omega.vercel.app/0.0.0.0\naddress=/quatangchoem.vercel.app/0.0.0.0\naddress=/social-lift-five.vercel.app/0.0.0.0\naddress=/www.89237892.com/0.0.0.0\naddress=/loginmsftcheck.com/0.0.0.0\naddress=/www.vaegryyde.com/0.0.0.0\naddress=/portail-mlcrosoft.fr/0.0.0.0\naddress=/sp13ct-torek-biz-furon-kalem.pages.dev/0.0.0.0\naddress=/metumasckgnn.gitbook.io/0.0.0.0\naddress=/boadashboard-com.cercel.app/0.0.0.0\naddress=/roblox.ss/0.0.0.0\naddress=/send-dt-bsc.vercel.app/0.0.0.0\naddress=/tokemie-cdn6-hk1.cfd/0.0.0.0\naddress=/mydpd.xzphm.top/0.0.0.0\naddress=/b6a2f96c.hyt65chn.pages.dev/0.0.0.0\naddress=/qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev/0.0.0.0\naddress=/mydpd.udovl.top/0.0.0.0\naddress=/mydpd.orauw.help/0.0.0.0\naddress=/mfacebookk.com.vn/0.0.0.0\naddress=/rb922.top/0.0.0.0\naddress=/www.paypall-login.blogspot.com/0.0.0.0\naddress=/busy-portion-128853.framer.app/0.0.0.0\naddress=/sunrisewebee.jimdofree.com/0.0.0.0\naddress=/qmdhr3b3wy.hdply.com/0.0.0.0\naddress=/sp31ct-tavaro-biz-nelzi-kumep.pages.dev/0.0.0.0\naddress=/log.verified-access.com/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/btdh-0x8t6v-awl75-p8wm-vfx.pages.dev/0.0.0.0\naddress=/primenord.vip/0.0.0.0\naddress=/viewfileshares.com/0.0.0.0\naddress=/www.roblox.com.ss/0.0.0.0\naddress=/saks.global.mamje.com/0.0.0.0\naddress=/app-download-ledger-live.pages.dev/0.0.0.0\naddress=/makcollins.github.io/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/sp10ct-burem-biz8-zadel-kofin.pages.dev/0.0.0.0\naddress=/data-in-project.dynv6.net/0.0.0.0\naddress=/21a1a1s2.pages.dev/0.0.0.0\naddress=/amazon-section-opal.vercel.app/0.0.0.0\naddress=/finance-tracker-4ay.pages.dev/0.0.0.0\naddress=/signbolemail.com/0.0.0.0\naddress=/4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev/0.0.0.0\naddress=/tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev/0.0.0.0\naddress=/qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev/0.0.0.0\naddress=/www.roblox.ly/0.0.0.0\naddress=/lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev/0.0.0.0\naddress=/6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-05.conf
log "Executing: touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-05/,/# END EXULTIA-OPENPHISH-2026-11-05/d' /etc/hosts 2>/dev/null || true"
touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-05/,/# END EXULTIA-OPENPHISH-2026-11-05/d' /etc/hosts 2>/dev/null || true
log "Executing: printf \"# BEGIN EXULTIA-OPENPHISH-2026-11-05\n0.0.0.0 www.metamaskchromeextensionn.blogspot.com\n0.0.0.0 www.sideaapliccacccionn.com\n0.0.0.0 indexxjjo.vercel.app\n0.0.0.0 www.upgraded-dollop-omega.vercel.app\n0.0.0.0 quatangchoem.vercel.app\n0.0.0.0 social-lift-five.vercel.app\n0.0.0.0 www.89237892.com\n0.0.0.0 loginmsftcheck.com\n0.0.0.0 www.vaegryyde.com\n0.0.0.0 portail-mlcrosoft.fr\n0.0.0.0 sp13ct-torek-biz-furon-kalem.pages.dev\n0.0.0.0 metumasckgnn.gitbook.io\n0.0.0.0 boadashboard-com.cercel.app\n0.0.0.0 roblox.ss\n0.0.0.0 send-dt-bsc.vercel.app\n0.0.0.0 tokemie-cdn6-hk1.cfd\n0.0.0.0 mydpd.xzphm.top\n0.0.0.0 b6a2f96c.hyt65chn.pages.dev\n0.0.0.0 qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\n0.0.0.0 mydpd.udovl.top\n0.0.0.0 mydpd.orauw.help\n0.0.0.0 mfacebookk.com.vn\n0.0.0.0 rb922.top\n0.0.0.0 www.paypall-login.blogspot.com\n0.0.0.0 busy-portion-128853.framer.app\n0.0.0.0 sunrisewebee.jimdofree.com\n0.0.0.0 qmdhr3b3wy.hdply.com\n0.0.0.0 sp31ct-tavaro-biz-nelzi-kumep.pages.dev\n0.0.0.0 log.verified-access.com\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 btdh-0x8t6v-awl75-p8wm-vfx.pages.dev\n0.0.0.0 primenord.vip\n0.0.0.0 viewfileshares.com\n0.0.0.0 www.roblox.com.ss\n0.0.0.0 saks.global.mamje.com\n0.0.0.0 app-download-ledger-live.pages.dev\n0.0.0.0 makcollins.github.io\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 sp10ct-burem-biz8-zadel-kofin.pages.dev\n0.0.0.0 data-in-project.dynv6.net\n0.0.0.0 21a1a1s2.pages.dev\n0.0.0.0 amazon-section-opal.vercel.app\n0.0.0.0 finance-tracker-4ay.pages.dev\n0.0.0.0 signbolemail.com\n0.0.0.0 4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\n0.0.0.0 tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\n0.0.0.0 qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\n0.0.0.0 www.roblox.ly\n0.0.0.0 lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n0.0.0.0 6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev\n# END EXULTIA-OPENPHISH-2026-11-05\n\" >> /etc/hosts"
printf "# BEGIN EXULTIA-OPENPHISH-2026-11-05\n0.0.0.0 www.metamaskchromeextensionn.blogspot.com\n0.0.0.0 www.sideaapliccacccionn.com\n0.0.0.0 indexxjjo.vercel.app\n0.0.0.0 www.upgraded-dollop-omega.vercel.app\n0.0.0.0 quatangchoem.vercel.app\n0.0.0.0 social-lift-five.vercel.app\n0.0.0.0 www.89237892.com\n0.0.0.0 loginmsftcheck.com\n0.0.0.0 www.vaegryyde.com\n0.0.0.0 portail-mlcrosoft.fr\n0.0.0.0 sp13ct-torek-biz-furon-kalem.pages.dev\n0.0.0.0 metumasckgnn.gitbook.io\n0.0.0.0 boadashboard-com.cercel.app\n0.0.0.0 roblox.ss\n0.0.0.0 send-dt-bsc.vercel.app\n0.0.0.0 tokemie-cdn6-hk1.cfd\n0.0.0.0 mydpd.xzphm.top\n0.0.0.0 b6a2f96c.hyt65chn.pages.dev\n0.0.0.0 qsc6f02dr-zptrkpli-0u1s5g-qsc63c.pages.dev\n0.0.0.0 mydpd.udovl.top\n0.0.0.0 mydpd.orauw.help\n0.0.0.0 mfacebookk.com.vn\n0.0.0.0 rb922.top\n0.0.0.0 www.paypall-login.blogspot.com\n0.0.0.0 busy-portion-128853.framer.app\n0.0.0.0 sunrisewebee.jimdofree.com\n0.0.0.0 qmdhr3b3wy.hdply.com\n0.0.0.0 sp31ct-tavaro-biz-nelzi-kumep.pages.dev\n0.0.0.0 log.verified-access.com\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 btdh-0x8t6v-awl75-p8wm-vfx.pages.dev\n0.0.0.0 primenord.vip\n0.0.0.0 viewfileshares.com\n0.0.0.0 www.roblox.com.ss\n0.0.0.0 saks.global.mamje.com\n0.0.0.0 app-download-ledger-live.pages.dev\n0.0.0.0 makcollins.github.io\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 sp10ct-burem-biz8-zadel-kofin.pages.dev\n0.0.0.0 data-in-project.dynv6.net\n0.0.0.0 21a1a1s2.pages.dev\n0.0.0.0 amazon-section-opal.vercel.app\n0.0.0.0 finance-tracker-4ay.pages.dev\n0.0.0.0 signbolemail.com\n0.0.0.0 4r8p2e-1v9m8p1a-1k8z9p2m4s-2m1p.pages.dev\n0.0.0.0 tdr52-4j41kq-pjq49-los-7x6t2b-tdr52-86w.pages.dev\n0.0.0.0 qtz15-184kf-xjn39-184pd-2b5c8d-bdf88-184c.pages.dev\n0.0.0.0 www.roblox.ly\n0.0.0.0 lpr47-140lk-mvk62-140wu-4b1c3d-lpr47-140p.pages.dev\n0.0.0.0 6u1m2c-qw333a-mbtz8z2p1m9-qwxknnnx.pages.dev\n# END EXULTIA-OPENPHISH-2026-11-05\n" >> /etc/hosts

# Execute verification sentinel probe
log "Executing verification sentinel probe..."
if test -s /etc/exultia/blocklists/openphish-2026-11-05.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-05" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts; then
  log "SUCCESS: Verification passed. UVI-2026-11-00000158 successfully mitigated."
else
  log "CRITICAL: Verification sentinel failed! Initiating emergency rollback..."
  sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-05/,/# END EXULTIA-OPENPHISH-2026-11-05/d' /etc/hosts 2>/dev/null || true; rm -f /etc/exultia/blocklists/openphish-2026-11-05.domains /etc/exultia/blocklists/dns-sinkhole-2026-11-05.conf
  err "Rollback complete. System restored to baseline state."
fi