Exultia Technologies Cybernetic Fortress Helm
EXULTIA
TECHNOLOGIES
← Back to CVE Catalog/UVI-2026-11-00000181

UVI-2026-11-00000181

CVSS 9.1 (CRITICAL)
Published: 11/5/2026

OpenPhish Zero-Day Phishing Portal Digest (2026-11-06): 300 Active Portals

Affected Packagesphp-common, php-cli, php-fpm
Supported Environmentsubuntu, debian, linux-mint, rocky, rhel, almalinux, oracle-linux, suse, alpine, arch, fedora, amazon-linux, kernel, gentoo, freebsd, openbsd, netbsd, macos, wolfi, nixos, void, photon, flatcar, talos, openwrt, openeuler, cloudlinux, kali, azure-linux, centos-stream, opensuse-leap, fedora-coreos, proxmox, truenas-scale, windows
Cryptographic ProvenanceSLSA Level 3 (Cosign OIDC Signed)
⚡ Autonomous Live Mitigation(Zero-Downtime • Sub-50ms Rollback)

Deploy this patch across production Linux or Windows Server fleets with pre-flight sentinels and instant rollback guarantee.

exultia.exe patch --vendor --os windows-server
Tier 1

Zero-Downtime Hot-Mitigation Script

No reboot or service downtime

Sinkhole 82 active phishing domains to 0.0.0.0 in /etc/hosts and local DNS resolver.

mkdir -p /etc/exultia/blocklists
printf "%b\n" "smcparral.com\n2h.ae\nios.app-lmaxex.top\ne3x4x3w.pages.dev\n394834binance.com\nicloud-appleinc.com\npmh-ledger.pages.dev\nzerobit497-zkku.blogspot.com\nhelp-docs-metamask.gitbook.io\nshared-documents-access.shared-object-038572.workers.dev\nweb-trezor-io-start-trezor-suite-app-cdn.typedream.app\n370941383545690465507436650778.roomcaronmoons.sbs\nwww.telstramail-kyc-trial.weebly.com\nhigbkr.vercel.app\ndfjhdfjhdf.weebly.com\nwmbrnq.eventzones.de\ninstagram-login00.blogspot.com\ntaskportal-aelvorith-475c.s2499574.workers.dev\nsomewhatshreya.github.io\nuser1229.invoice-admin-agency.com\naccounts.invoice-admin-agency.com\nwww.dhl-login-details.vercel.app\ntaskportal-thavoryx-bdf5.s2499574.workers.dev\nhub-ledgrlive-eng.pages.dev\nfacebook-clone-sandeep-morya.vercel.app\nsp10ct10-qunvek-biz-vumeni-kemra.pages.dev\nlpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\nroomcaronmoons.sbs\nwhatsapp-quickchat.vercel.app\nt-mobile.dvcqu.shop\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\ncustomer-sp-hernandespule.pages.dev\nwww.roblox.com.gr\nfreelancer.id875422.shop\n121jio.senes.at\nwww.prestamo-santander-cliente.vercel.app\n384734-apple.com\nticket-cancel-apple.com\nxni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\nsp10ct10-kelvani-biz-zumrako.pages.dev\nxernqelo-mpt-belzavi-r6d9me35.pages.dev\nnorzuni-mpt-qelmavo-c5x7fe83.pages.dev\nbdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\nqnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\nzrob-skel-frip-184-prup-trandis-vug-753.pages.dev\nmail.ttkrewards.vip\nen-trezor-suite-io.square.site\nwww.roblox.com.kz\nwww.goo.su\nmeetingdiscussion.weupdaa.workers.dev" > /etc/exultia/blocklists/openphish-2026-11-06.domains
printf "%b\n" "address=/smcparral.com/0.0.0.0\naddress=/2h.ae/0.0.0.0\naddress=/ios.app-lmaxex.top/0.0.0.0\naddress=/e3x4x3w.pages.dev/0.0.0.0\naddress=/394834binance.com/0.0.0.0\naddress=/icloud-appleinc.com/0.0.0.0\naddress=/pmh-ledger.pages.dev/0.0.0.0\naddress=/zerobit497-zkku.blogspot.com/0.0.0.0\naddress=/help-docs-metamask.gitbook.io/0.0.0.0\naddress=/shared-documents-access.shared-object-038572.workers.dev/0.0.0.0\naddress=/web-trezor-io-start-trezor-suite-app-cdn.typedream.app/0.0.0.0\naddress=/370941383545690465507436650778.roomcaronmoons.sbs/0.0.0.0\naddress=/www.telstramail-kyc-trial.weebly.com/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/dfjhdfjhdf.weebly.com/0.0.0.0\naddress=/wmbrnq.eventzones.de/0.0.0.0\naddress=/instagram-login00.blogspot.com/0.0.0.0\naddress=/taskportal-aelvorith-475c.s2499574.workers.dev/0.0.0.0\naddress=/somewhatshreya.github.io/0.0.0.0\naddress=/user1229.invoice-admin-agency.com/0.0.0.0\naddress=/accounts.invoice-admin-agency.com/0.0.0.0\naddress=/www.dhl-login-details.vercel.app/0.0.0.0\naddress=/taskportal-thavoryx-bdf5.s2499574.workers.dev/0.0.0.0\naddress=/hub-ledgrlive-eng.pages.dev/0.0.0.0\naddress=/facebook-clone-sandeep-morya.vercel.app/0.0.0.0\naddress=/sp10ct10-qunvek-biz-vumeni-kemra.pages.dev/0.0.0.0\naddress=/lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev/0.0.0.0\naddress=/roomcaronmoons.sbs/0.0.0.0\naddress=/whatsapp-quickchat.vercel.app/0.0.0.0\naddress=/t-mobile.dvcqu.shop/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/customer-sp-hernandespule.pages.dev/0.0.0.0\naddress=/www.roblox.com.gr/0.0.0.0\naddress=/freelancer.id875422.shop/0.0.0.0\naddress=/121jio.senes.at/0.0.0.0\naddress=/www.prestamo-santander-cliente.vercel.app/0.0.0.0\naddress=/384734-apple.com/0.0.0.0\naddress=/ticket-cancel-apple.com/0.0.0.0\naddress=/xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev/0.0.0.0\naddress=/sp10ct10-kelvani-biz-zumrako.pages.dev/0.0.0.0\naddress=/xernqelo-mpt-belzavi-r6d9me35.pages.dev/0.0.0.0\naddress=/norzuni-mpt-qelmavo-c5x7fe83.pages.dev/0.0.0.0\naddress=/bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev/0.0.0.0\naddress=/qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev/0.0.0.0\naddress=/zrob-skel-frip-184-prup-trandis-vug-753.pages.dev/0.0.0.0\naddress=/mail.ttkrewards.vip/0.0.0.0\naddress=/en-trezor-suite-io.square.site/0.0.0.0\naddress=/www.roblox.com.kz/0.0.0.0\naddress=/www.goo.su/0.0.0.0\naddress=/meetingdiscussion.weupdaa.workers.dev/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-06.conf
touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-06/,/# END EXULTIA-OPENPHISH-2026-11-06/d' /etc/hosts 2>/dev/null || true
printf "# BEGIN EXULTIA-OPENPHISH-2026-11-06\n0.0.0.0 smcparral.com\n0.0.0.0 2h.ae\n0.0.0.0 ios.app-lmaxex.top\n0.0.0.0 e3x4x3w.pages.dev\n0.0.0.0 394834binance.com\n0.0.0.0 icloud-appleinc.com\n0.0.0.0 pmh-ledger.pages.dev\n0.0.0.0 zerobit497-zkku.blogspot.com\n0.0.0.0 help-docs-metamask.gitbook.io\n0.0.0.0 shared-documents-access.shared-object-038572.workers.dev\n0.0.0.0 web-trezor-io-start-trezor-suite-app-cdn.typedream.app\n0.0.0.0 370941383545690465507436650778.roomcaronmoons.sbs\n0.0.0.0 www.telstramail-kyc-trial.weebly.com\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 dfjhdfjhdf.weebly.com\n0.0.0.0 wmbrnq.eventzones.de\n0.0.0.0 instagram-login00.blogspot.com\n0.0.0.0 taskportal-aelvorith-475c.s2499574.workers.dev\n0.0.0.0 somewhatshreya.github.io\n0.0.0.0 user1229.invoice-admin-agency.com\n0.0.0.0 accounts.invoice-admin-agency.com\n0.0.0.0 www.dhl-login-details.vercel.app\n0.0.0.0 taskportal-thavoryx-bdf5.s2499574.workers.dev\n0.0.0.0 hub-ledgrlive-eng.pages.dev\n0.0.0.0 facebook-clone-sandeep-morya.vercel.app\n0.0.0.0 sp10ct10-qunvek-biz-vumeni-kemra.pages.dev\n0.0.0.0 lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\n0.0.0.0 roomcaronmoons.sbs\n0.0.0.0 whatsapp-quickchat.vercel.app\n0.0.0.0 t-mobile.dvcqu.shop\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 customer-sp-hernandespule.pages.dev\n0.0.0.0 www.roblox.com.gr\n0.0.0.0 freelancer.id875422.shop\n0.0.0.0 121jio.senes.at\n0.0.0.0 www.prestamo-santander-cliente.vercel.app\n0.0.0.0 384734-apple.com\n0.0.0.0 ticket-cancel-apple.com\n0.0.0.0 xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\n0.0.0.0 sp10ct10-kelvani-biz-zumrako.pages.dev\n0.0.0.0 xernqelo-mpt-belzavi-r6d9me35.pages.dev\n0.0.0.0 norzuni-mpt-qelmavo-c5x7fe83.pages.dev\n0.0.0.0 bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\n0.0.0.0 qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\n0.0.0.0 zrob-skel-frip-184-prup-trandis-vug-753.pages.dev\n0.0.0.0 mail.ttkrewards.vip\n0.0.0.0 en-trezor-suite-io.square.site\n0.0.0.0 www.roblox.com.kz\n0.0.0.0 www.goo.su\n0.0.0.0 meetingdiscussion.weupdaa.workers.dev\n# END EXULTIA-OPENPHISH-2026-11-06\n" >> /etc/hosts
🔍 Verification Sentinel Probe:
test -s /etc/exultia/blocklists/openphish-2026-11-06.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-06" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts
⏪ Sub-50ms Deterministic Rollback:
sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-06/,/# END EXULTIA-OPENPHISH-2026-11-06/d' /etc/hosts 2>/dev/null || true; rm -f /etc/exultia/blocklists/openphish-2026-11-06.domains /etc/exultia/blocklists/dns-sinkhole-2026-11-06.conf
Tier 3

Serialized 10% Canary Ansible Playbook

Fleet configuration management

Hardened Ansible playbook with staged canary progression (serial: 10%), configuration validation, and handler reload.

---
- name: Exultia Validated Fix - UVI-2026-11-00000181 (DNS Resolver & Host Sinkhole (/etc/hosts / dnsmasq))
  hosts: all
  become: yes
  serial: "10%"
  tasks:
    - name: Apply Validated Fix (EXPR-PERIMETER-DNS-SINKHOLE)
      ansible.builtin.shell: |
        mkdir -p /etc/exultia/blocklists
        printf "%b\n" "smcparral.com\n2h.ae\nios.app-lmaxex.top\ne3x4x3w.pages.dev\n394834binance.com\nicloud-appleinc.com\npmh-ledger.pages.dev\nzerobit497-zkku.blogspot.com\nhelp-docs-metamask.gitbook.io\nshared-documents-access.shared-object-038572.workers.dev\nweb-trezor-io-start-trezor-suite-app-cdn.typedream.app\n370941383545690465507436650778.roomcaronmoons.sbs\nwww.telstramail-kyc-trial.weebly.com\nhigbkr.vercel.app\ndfjhdfjhdf.weebly.com\nwmbrnq.eventzones.de\ninstagram-login00.blogspot.com\ntaskportal-aelvorith-475c.s2499574.workers.dev\nsomewhatshreya.github.io\nuser1229.invoice-admin-agency.com\naccounts.invoice-admin-agency.com\nwww.dhl-login-details.vercel.app\ntaskportal-thavoryx-bdf5.s2499574.workers.dev\nhub-ledgrlive-eng.pages.dev\nfacebook-clone-sandeep-morya.vercel.app\nsp10ct10-qunvek-biz-vumeni-kemra.pages.dev\nlpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\nroomcaronmoons.sbs\nwhatsapp-quickchat.vercel.app\nt-mobile.dvcqu.shop\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\ncustomer-sp-hernandespule.pages.dev\nwww.roblox.com.gr\nfreelancer.id875422.shop\n121jio.senes.at\nwww.prestamo-santander-cliente.vercel.app\n384734-apple.com\nticket-cancel-apple.com\nxni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\nsp10ct10-kelvani-biz-zumrako.pages.dev\nxernqelo-mpt-belzavi-r6d9me35.pages.dev\nnorzuni-mpt-qelmavo-c5x7fe83.pages.dev\nbdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\nqnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\nzrob-skel-frip-184-prup-trandis-vug-753.pages.dev\nmail.ttkrewards.vip\nen-trezor-suite-io.square.site\nwww.roblox.com.kz\nwww.goo.su\nmeetingdiscussion.weupdaa.workers.dev" > /etc/exultia/blocklists/openphish-2026-11-06.domains
        printf "%b\n" "address=/smcparral.com/0.0.0.0\naddress=/2h.ae/0.0.0.0\naddress=/ios.app-lmaxex.top/0.0.0.0\naddress=/e3x4x3w.pages.dev/0.0.0.0\naddress=/394834binance.com/0.0.0.0\naddress=/icloud-appleinc.com/0.0.0.0\naddress=/pmh-ledger.pages.dev/0.0.0.0\naddress=/zerobit497-zkku.blogspot.com/0.0.0.0\naddress=/help-docs-metamask.gitbook.io/0.0.0.0\naddress=/shared-documents-access.shared-object-038572.workers.dev/0.0.0.0\naddress=/web-trezor-io-start-trezor-suite-app-cdn.typedream.app/0.0.0.0\naddress=/370941383545690465507436650778.roomcaronmoons.sbs/0.0.0.0\naddress=/www.telstramail-kyc-trial.weebly.com/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/dfjhdfjhdf.weebly.com/0.0.0.0\naddress=/wmbrnq.eventzones.de/0.0.0.0\naddress=/instagram-login00.blogspot.com/0.0.0.0\naddress=/taskportal-aelvorith-475c.s2499574.workers.dev/0.0.0.0\naddress=/somewhatshreya.github.io/0.0.0.0\naddress=/user1229.invoice-admin-agency.com/0.0.0.0\naddress=/accounts.invoice-admin-agency.com/0.0.0.0\naddress=/www.dhl-login-details.vercel.app/0.0.0.0\naddress=/taskportal-thavoryx-bdf5.s2499574.workers.dev/0.0.0.0\naddress=/hub-ledgrlive-eng.pages.dev/0.0.0.0\naddress=/facebook-clone-sandeep-morya.vercel.app/0.0.0.0\naddress=/sp10ct10-qunvek-biz-vumeni-kemra.pages.dev/0.0.0.0\naddress=/lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev/0.0.0.0\naddress=/roomcaronmoons.sbs/0.0.0.0\naddress=/whatsapp-quickchat.vercel.app/0.0.0.0\naddress=/t-mobile.dvcqu.shop/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/customer-sp-hernandespule.pages.dev/0.0.0.0\naddress=/www.roblox.com.gr/0.0.0.0\naddress=/freelancer.id875422.shop/0.0.0.0\naddress=/121jio.senes.at/0.0.0.0\naddress=/www.prestamo-santander-cliente.vercel.app/0.0.0.0\naddress=/384734-apple.com/0.0.0.0\naddress=/ticket-cancel-apple.com/0.0.0.0\naddress=/xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev/0.0.0.0\naddress=/sp10ct10-kelvani-biz-zumrako.pages.dev/0.0.0.0\naddress=/xernqelo-mpt-belzavi-r6d9me35.pages.dev/0.0.0.0\naddress=/norzuni-mpt-qelmavo-c5x7fe83.pages.dev/0.0.0.0\naddress=/bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev/0.0.0.0\naddress=/qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev/0.0.0.0\naddress=/zrob-skel-frip-184-prup-trandis-vug-753.pages.dev/0.0.0.0\naddress=/mail.ttkrewards.vip/0.0.0.0\naddress=/en-trezor-suite-io.square.site/0.0.0.0\naddress=/www.roblox.com.kz/0.0.0.0\naddress=/www.goo.su/0.0.0.0\naddress=/meetingdiscussion.weupdaa.workers.dev/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-06.conf
        touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-06/,/# END EXULTIA-OPENPHISH-2026-11-06/d' /etc/hosts 2>/dev/null || true
        printf "# BEGIN EXULTIA-OPENPHISH-2026-11-06\n0.0.0.0 smcparral.com\n0.0.0.0 2h.ae\n0.0.0.0 ios.app-lmaxex.top\n0.0.0.0 e3x4x3w.pages.dev\n0.0.0.0 394834binance.com\n0.0.0.0 icloud-appleinc.com\n0.0.0.0 pmh-ledger.pages.dev\n0.0.0.0 zerobit497-zkku.blogspot.com\n0.0.0.0 help-docs-metamask.gitbook.io\n0.0.0.0 shared-documents-access.shared-object-038572.workers.dev\n0.0.0.0 web-trezor-io-start-trezor-suite-app-cdn.typedream.app\n0.0.0.0 370941383545690465507436650778.roomcaronmoons.sbs\n0.0.0.0 www.telstramail-kyc-trial.weebly.com\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 dfjhdfjhdf.weebly.com\n0.0.0.0 wmbrnq.eventzones.de\n0.0.0.0 instagram-login00.blogspot.com\n0.0.0.0 taskportal-aelvorith-475c.s2499574.workers.dev\n0.0.0.0 somewhatshreya.github.io\n0.0.0.0 user1229.invoice-admin-agency.com\n0.0.0.0 accounts.invoice-admin-agency.com\n0.0.0.0 www.dhl-login-details.vercel.app\n0.0.0.0 taskportal-thavoryx-bdf5.s2499574.workers.dev\n0.0.0.0 hub-ledgrlive-eng.pages.dev\n0.0.0.0 facebook-clone-sandeep-morya.vercel.app\n0.0.0.0 sp10ct10-qunvek-biz-vumeni-kemra.pages.dev\n0.0.0.0 lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\n0.0.0.0 roomcaronmoons.sbs\n0.0.0.0 whatsapp-quickchat.vercel.app\n0.0.0.0 t-mobile.dvcqu.shop\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 customer-sp-hernandespule.pages.dev\n0.0.0.0 www.roblox.com.gr\n0.0.0.0 freelancer.id875422.shop\n0.0.0.0 121jio.senes.at\n0.0.0.0 www.prestamo-santander-cliente.vercel.app\n0.0.0.0 384734-apple.com\n0.0.0.0 ticket-cancel-apple.com\n0.0.0.0 xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\n0.0.0.0 sp10ct10-kelvani-biz-zumrako.pages.dev\n0.0.0.0 xernqelo-mpt-belzavi-r6d9me35.pages.dev\n0.0.0.0 norzuni-mpt-qelmavo-c5x7fe83.pages.dev\n0.0.0.0 bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\n0.0.0.0 qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\n0.0.0.0 zrob-skel-frip-184-prup-trandis-vug-753.pages.dev\n0.0.0.0 mail.ttkrewards.vip\n0.0.0.0 en-trezor-suite-io.square.site\n0.0.0.0 www.roblox.com.kz\n0.0.0.0 www.goo.su\n0.0.0.0 meetingdiscussion.weupdaa.workers.dev\n# END EXULTIA-OPENPHISH-2026-11-06\n" >> /etc/hosts
      args:
        executable: /bin/sh
      register: kinetic_exec
      failed_when: kinetic_exec.rc != 0

    - name: Verify Post-Fix Gate
      ansible.builtin.shell: "test -s /etc/exultia/blocklists/openphish-2026-11-06.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-06" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts"
      changed_when: false
Tier 2

Vendor OS Package Upgrade Commands

Native package manager reconciliation
ubuntuDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
debianDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
kaliDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
linux-mintDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
proxmoxDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
truenas-scaleDEBIAN_FRONTEND=noninteractive apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y php-common php-cli php-fpm
rockydnf upgrade -y php-common php-cli php-fpm
rheldnf upgrade -y php-common php-cli php-fpm
almalinuxdnf upgrade -y php-common php-cli php-fpm
oracle-linuxdnf upgrade -y php-common php-cli php-fpm
cloudlinuxdnf upgrade -y php-common php-cli php-fpm
amazon-linuxdnf upgrade -y php-common php-cli php-fpm
fedoradnf upgrade -y php-common php-cli php-fpm
openeulerdnf upgrade -y php-common php-cli php-fpm
centos-streamdnf upgrade -y php-common php-cli php-fpm
azure-linuxtdnf update -y php-common php-cli php-fpm
photontdnf update -y php-common php-cli php-fpm
alpineapk update -q && apk upgrade --no-cache php83 php83-fpm
wolfiapk update -q && apk upgrade --no-cache php83 php83-fpm
susezypper --non-interactive update php-common php-cli php-fpm
opensuse-leapzypper --non-interactive update php-common php-cli php-fpm
archpacman -S --noconfirm php-common
gentooemerge --update --oneshot php-common
voidxbps-install -Su -y php-common
nixosnix-env -u php-common
openwrtopkg update && opkg upgrade php-common
freebsdpkg upgrade -y php-common
openbsdsyspatch
netbsdpkgin -y upgrade
fedora-coreosrpm-ostree upgrade
flatcarupdate_engine_client -check_for_update
talostalosctl upgrade-k8s
macossoftwareupdate -i -a

Full Standalone Hotfix Script

Complete, self-contained remediation script with privileges check, logging, pre-flight safety, and automatic rollback on verification failure:

#!/bin/sh
# ==============================================================================
# Exultia Surgical Remediation: UVI-2026-11-00000181
# Title: OpenPhish Zero-Day Phishing Portal Digest (2026-11-06): 300 Active Portals
# CVSS Score: 9.1 (CRITICAL) | CISA KEV: NO
# Provenance: [email protected] (Cosign OIDC Keyless) | SLSA Level 3
# Generated by Exultia Autonomous Remediation Engine (https://exultia.tech/cve/UVI-2026-11-00000181)
# ==============================================================================
set -e

log() { echo "[Exultia] $(date +'%Y-%m-%d %H:%M:%S') $1"; }
err() { echo "[Exultia] ERROR: $1" >&2; exit 1; }

if [ "$(id -u)" -ne 0 ]; then
  err "Root privileges required. Run with sudo or as root."
fi

log "Initiating zero-downtime hot-mitigation for UVI-2026-11-00000181..."

# Apply mitigation commands
log "Executing: mkdir -p /etc/exultia/blocklists"
mkdir -p /etc/exultia/blocklists
log "Executing: printf \"%b\n\" \"smcparral.com\n2h.ae\nios.app-lmaxex.top\ne3x4x3w.pages.dev\n394834binance.com\nicloud-appleinc.com\npmh-ledger.pages.dev\nzerobit497-zkku.blogspot.com\nhelp-docs-metamask.gitbook.io\nshared-documents-access.shared-object-038572.workers.dev\nweb-trezor-io-start-trezor-suite-app-cdn.typedream.app\n370941383545690465507436650778.roomcaronmoons.sbs\nwww.telstramail-kyc-trial.weebly.com\nhigbkr.vercel.app\ndfjhdfjhdf.weebly.com\nwmbrnq.eventzones.de\ninstagram-login00.blogspot.com\ntaskportal-aelvorith-475c.s2499574.workers.dev\nsomewhatshreya.github.io\nuser1229.invoice-admin-agency.com\naccounts.invoice-admin-agency.com\nwww.dhl-login-details.vercel.app\ntaskportal-thavoryx-bdf5.s2499574.workers.dev\nhub-ledgrlive-eng.pages.dev\nfacebook-clone-sandeep-morya.vercel.app\nsp10ct10-qunvek-biz-vumeni-kemra.pages.dev\nlpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\nroomcaronmoons.sbs\nwhatsapp-quickchat.vercel.app\nt-mobile.dvcqu.shop\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\ncustomer-sp-hernandespule.pages.dev\nwww.roblox.com.gr\nfreelancer.id875422.shop\n121jio.senes.at\nwww.prestamo-santander-cliente.vercel.app\n384734-apple.com\nticket-cancel-apple.com\nxni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\nsp10ct10-kelvani-biz-zumrako.pages.dev\nxernqelo-mpt-belzavi-r6d9me35.pages.dev\nnorzuni-mpt-qelmavo-c5x7fe83.pages.dev\nbdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\nqnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\nzrob-skel-frip-184-prup-trandis-vug-753.pages.dev\nmail.ttkrewards.vip\nen-trezor-suite-io.square.site\nwww.roblox.com.kz\nwww.goo.su\nmeetingdiscussion.weupdaa.workers.dev\" > /etc/exultia/blocklists/openphish-2026-11-06.domains"
printf "%b\n" "smcparral.com\n2h.ae\nios.app-lmaxex.top\ne3x4x3w.pages.dev\n394834binance.com\nicloud-appleinc.com\npmh-ledger.pages.dev\nzerobit497-zkku.blogspot.com\nhelp-docs-metamask.gitbook.io\nshared-documents-access.shared-object-038572.workers.dev\nweb-trezor-io-start-trezor-suite-app-cdn.typedream.app\n370941383545690465507436650778.roomcaronmoons.sbs\nwww.telstramail-kyc-trial.weebly.com\nhigbkr.vercel.app\ndfjhdfjhdf.weebly.com\nwmbrnq.eventzones.de\ninstagram-login00.blogspot.com\ntaskportal-aelvorith-475c.s2499574.workers.dev\nsomewhatshreya.github.io\nuser1229.invoice-admin-agency.com\naccounts.invoice-admin-agency.com\nwww.dhl-login-details.vercel.app\ntaskportal-thavoryx-bdf5.s2499574.workers.dev\nhub-ledgrlive-eng.pages.dev\nfacebook-clone-sandeep-morya.vercel.app\nsp10ct10-qunvek-biz-vumeni-kemra.pages.dev\nlpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\nroomcaronmoons.sbs\nwhatsapp-quickchat.vercel.app\nt-mobile.dvcqu.shop\nzarnel-privex-biz-holvik-santor-fdp1912.pages.dev\ncustomer-sp-hernandespule.pages.dev\nwww.roblox.com.gr\nfreelancer.id875422.shop\n121jio.senes.at\nwww.prestamo-santander-cliente.vercel.app\n384734-apple.com\nticket-cancel-apple.com\nxni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\nsp10ct10-kelvani-biz-zumrako.pages.dev\nxernqelo-mpt-belzavi-r6d9me35.pages.dev\nnorzuni-mpt-qelmavo-c5x7fe83.pages.dev\nbdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\nqnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\nzrob-skel-frip-184-prup-trandis-vug-753.pages.dev\nmail.ttkrewards.vip\nen-trezor-suite-io.square.site\nwww.roblox.com.kz\nwww.goo.su\nmeetingdiscussion.weupdaa.workers.dev" > /etc/exultia/blocklists/openphish-2026-11-06.domains
log "Executing: printf \"%b\n\" \"address=/smcparral.com/0.0.0.0\naddress=/2h.ae/0.0.0.0\naddress=/ios.app-lmaxex.top/0.0.0.0\naddress=/e3x4x3w.pages.dev/0.0.0.0\naddress=/394834binance.com/0.0.0.0\naddress=/icloud-appleinc.com/0.0.0.0\naddress=/pmh-ledger.pages.dev/0.0.0.0\naddress=/zerobit497-zkku.blogspot.com/0.0.0.0\naddress=/help-docs-metamask.gitbook.io/0.0.0.0\naddress=/shared-documents-access.shared-object-038572.workers.dev/0.0.0.0\naddress=/web-trezor-io-start-trezor-suite-app-cdn.typedream.app/0.0.0.0\naddress=/370941383545690465507436650778.roomcaronmoons.sbs/0.0.0.0\naddress=/www.telstramail-kyc-trial.weebly.com/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/dfjhdfjhdf.weebly.com/0.0.0.0\naddress=/wmbrnq.eventzones.de/0.0.0.0\naddress=/instagram-login00.blogspot.com/0.0.0.0\naddress=/taskportal-aelvorith-475c.s2499574.workers.dev/0.0.0.0\naddress=/somewhatshreya.github.io/0.0.0.0\naddress=/user1229.invoice-admin-agency.com/0.0.0.0\naddress=/accounts.invoice-admin-agency.com/0.0.0.0\naddress=/www.dhl-login-details.vercel.app/0.0.0.0\naddress=/taskportal-thavoryx-bdf5.s2499574.workers.dev/0.0.0.0\naddress=/hub-ledgrlive-eng.pages.dev/0.0.0.0\naddress=/facebook-clone-sandeep-morya.vercel.app/0.0.0.0\naddress=/sp10ct10-qunvek-biz-vumeni-kemra.pages.dev/0.0.0.0\naddress=/lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev/0.0.0.0\naddress=/roomcaronmoons.sbs/0.0.0.0\naddress=/whatsapp-quickchat.vercel.app/0.0.0.0\naddress=/t-mobile.dvcqu.shop/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/customer-sp-hernandespule.pages.dev/0.0.0.0\naddress=/www.roblox.com.gr/0.0.0.0\naddress=/freelancer.id875422.shop/0.0.0.0\naddress=/121jio.senes.at/0.0.0.0\naddress=/www.prestamo-santander-cliente.vercel.app/0.0.0.0\naddress=/384734-apple.com/0.0.0.0\naddress=/ticket-cancel-apple.com/0.0.0.0\naddress=/xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev/0.0.0.0\naddress=/sp10ct10-kelvani-biz-zumrako.pages.dev/0.0.0.0\naddress=/xernqelo-mpt-belzavi-r6d9me35.pages.dev/0.0.0.0\naddress=/norzuni-mpt-qelmavo-c5x7fe83.pages.dev/0.0.0.0\naddress=/bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev/0.0.0.0\naddress=/qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev/0.0.0.0\naddress=/zrob-skel-frip-184-prup-trandis-vug-753.pages.dev/0.0.0.0\naddress=/mail.ttkrewards.vip/0.0.0.0\naddress=/en-trezor-suite-io.square.site/0.0.0.0\naddress=/www.roblox.com.kz/0.0.0.0\naddress=/www.goo.su/0.0.0.0\naddress=/meetingdiscussion.weupdaa.workers.dev/0.0.0.0\" > /etc/exultia/blocklists/dns-sinkhole-2026-11-06.conf"
printf "%b\n" "address=/smcparral.com/0.0.0.0\naddress=/2h.ae/0.0.0.0\naddress=/ios.app-lmaxex.top/0.0.0.0\naddress=/e3x4x3w.pages.dev/0.0.0.0\naddress=/394834binance.com/0.0.0.0\naddress=/icloud-appleinc.com/0.0.0.0\naddress=/pmh-ledger.pages.dev/0.0.0.0\naddress=/zerobit497-zkku.blogspot.com/0.0.0.0\naddress=/help-docs-metamask.gitbook.io/0.0.0.0\naddress=/shared-documents-access.shared-object-038572.workers.dev/0.0.0.0\naddress=/web-trezor-io-start-trezor-suite-app-cdn.typedream.app/0.0.0.0\naddress=/370941383545690465507436650778.roomcaronmoons.sbs/0.0.0.0\naddress=/www.telstramail-kyc-trial.weebly.com/0.0.0.0\naddress=/higbkr.vercel.app/0.0.0.0\naddress=/dfjhdfjhdf.weebly.com/0.0.0.0\naddress=/wmbrnq.eventzones.de/0.0.0.0\naddress=/instagram-login00.blogspot.com/0.0.0.0\naddress=/taskportal-aelvorith-475c.s2499574.workers.dev/0.0.0.0\naddress=/somewhatshreya.github.io/0.0.0.0\naddress=/user1229.invoice-admin-agency.com/0.0.0.0\naddress=/accounts.invoice-admin-agency.com/0.0.0.0\naddress=/www.dhl-login-details.vercel.app/0.0.0.0\naddress=/taskportal-thavoryx-bdf5.s2499574.workers.dev/0.0.0.0\naddress=/hub-ledgrlive-eng.pages.dev/0.0.0.0\naddress=/facebook-clone-sandeep-morya.vercel.app/0.0.0.0\naddress=/sp10ct10-qunvek-biz-vumeni-kemra.pages.dev/0.0.0.0\naddress=/lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev/0.0.0.0\naddress=/roomcaronmoons.sbs/0.0.0.0\naddress=/whatsapp-quickchat.vercel.app/0.0.0.0\naddress=/t-mobile.dvcqu.shop/0.0.0.0\naddress=/zarnel-privex-biz-holvik-santor-fdp1912.pages.dev/0.0.0.0\naddress=/customer-sp-hernandespule.pages.dev/0.0.0.0\naddress=/www.roblox.com.gr/0.0.0.0\naddress=/freelancer.id875422.shop/0.0.0.0\naddress=/121jio.senes.at/0.0.0.0\naddress=/www.prestamo-santander-cliente.vercel.app/0.0.0.0\naddress=/384734-apple.com/0.0.0.0\naddress=/ticket-cancel-apple.com/0.0.0.0\naddress=/xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev/0.0.0.0\naddress=/sp10ct10-kelvani-biz-zumrako.pages.dev/0.0.0.0\naddress=/xernqelo-mpt-belzavi-r6d9me35.pages.dev/0.0.0.0\naddress=/norzuni-mpt-qelmavo-c5x7fe83.pages.dev/0.0.0.0\naddress=/bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev/0.0.0.0\naddress=/qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev/0.0.0.0\naddress=/zrob-skel-frip-184-prup-trandis-vug-753.pages.dev/0.0.0.0\naddress=/mail.ttkrewards.vip/0.0.0.0\naddress=/en-trezor-suite-io.square.site/0.0.0.0\naddress=/www.roblox.com.kz/0.0.0.0\naddress=/www.goo.su/0.0.0.0\naddress=/meetingdiscussion.weupdaa.workers.dev/0.0.0.0" > /etc/exultia/blocklists/dns-sinkhole-2026-11-06.conf
log "Executing: touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-06/,/# END EXULTIA-OPENPHISH-2026-11-06/d' /etc/hosts 2>/dev/null || true"
touch /etc/hosts && sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-06/,/# END EXULTIA-OPENPHISH-2026-11-06/d' /etc/hosts 2>/dev/null || true
log "Executing: printf \"# BEGIN EXULTIA-OPENPHISH-2026-11-06\n0.0.0.0 smcparral.com\n0.0.0.0 2h.ae\n0.0.0.0 ios.app-lmaxex.top\n0.0.0.0 e3x4x3w.pages.dev\n0.0.0.0 394834binance.com\n0.0.0.0 icloud-appleinc.com\n0.0.0.0 pmh-ledger.pages.dev\n0.0.0.0 zerobit497-zkku.blogspot.com\n0.0.0.0 help-docs-metamask.gitbook.io\n0.0.0.0 shared-documents-access.shared-object-038572.workers.dev\n0.0.0.0 web-trezor-io-start-trezor-suite-app-cdn.typedream.app\n0.0.0.0 370941383545690465507436650778.roomcaronmoons.sbs\n0.0.0.0 www.telstramail-kyc-trial.weebly.com\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 dfjhdfjhdf.weebly.com\n0.0.0.0 wmbrnq.eventzones.de\n0.0.0.0 instagram-login00.blogspot.com\n0.0.0.0 taskportal-aelvorith-475c.s2499574.workers.dev\n0.0.0.0 somewhatshreya.github.io\n0.0.0.0 user1229.invoice-admin-agency.com\n0.0.0.0 accounts.invoice-admin-agency.com\n0.0.0.0 www.dhl-login-details.vercel.app\n0.0.0.0 taskportal-thavoryx-bdf5.s2499574.workers.dev\n0.0.0.0 hub-ledgrlive-eng.pages.dev\n0.0.0.0 facebook-clone-sandeep-morya.vercel.app\n0.0.0.0 sp10ct10-qunvek-biz-vumeni-kemra.pages.dev\n0.0.0.0 lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\n0.0.0.0 roomcaronmoons.sbs\n0.0.0.0 whatsapp-quickchat.vercel.app\n0.0.0.0 t-mobile.dvcqu.shop\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 customer-sp-hernandespule.pages.dev\n0.0.0.0 www.roblox.com.gr\n0.0.0.0 freelancer.id875422.shop\n0.0.0.0 121jio.senes.at\n0.0.0.0 www.prestamo-santander-cliente.vercel.app\n0.0.0.0 384734-apple.com\n0.0.0.0 ticket-cancel-apple.com\n0.0.0.0 xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\n0.0.0.0 sp10ct10-kelvani-biz-zumrako.pages.dev\n0.0.0.0 xernqelo-mpt-belzavi-r6d9me35.pages.dev\n0.0.0.0 norzuni-mpt-qelmavo-c5x7fe83.pages.dev\n0.0.0.0 bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\n0.0.0.0 qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\n0.0.0.0 zrob-skel-frip-184-prup-trandis-vug-753.pages.dev\n0.0.0.0 mail.ttkrewards.vip\n0.0.0.0 en-trezor-suite-io.square.site\n0.0.0.0 www.roblox.com.kz\n0.0.0.0 www.goo.su\n0.0.0.0 meetingdiscussion.weupdaa.workers.dev\n# END EXULTIA-OPENPHISH-2026-11-06\n\" >> /etc/hosts"
printf "# BEGIN EXULTIA-OPENPHISH-2026-11-06\n0.0.0.0 smcparral.com\n0.0.0.0 2h.ae\n0.0.0.0 ios.app-lmaxex.top\n0.0.0.0 e3x4x3w.pages.dev\n0.0.0.0 394834binance.com\n0.0.0.0 icloud-appleinc.com\n0.0.0.0 pmh-ledger.pages.dev\n0.0.0.0 zerobit497-zkku.blogspot.com\n0.0.0.0 help-docs-metamask.gitbook.io\n0.0.0.0 shared-documents-access.shared-object-038572.workers.dev\n0.0.0.0 web-trezor-io-start-trezor-suite-app-cdn.typedream.app\n0.0.0.0 370941383545690465507436650778.roomcaronmoons.sbs\n0.0.0.0 www.telstramail-kyc-trial.weebly.com\n0.0.0.0 higbkr.vercel.app\n0.0.0.0 dfjhdfjhdf.weebly.com\n0.0.0.0 wmbrnq.eventzones.de\n0.0.0.0 instagram-login00.blogspot.com\n0.0.0.0 taskportal-aelvorith-475c.s2499574.workers.dev\n0.0.0.0 somewhatshreya.github.io\n0.0.0.0 user1229.invoice-admin-agency.com\n0.0.0.0 accounts.invoice-admin-agency.com\n0.0.0.0 www.dhl-login-details.vercel.app\n0.0.0.0 taskportal-thavoryx-bdf5.s2499574.workers.dev\n0.0.0.0 hub-ledgrlive-eng.pages.dev\n0.0.0.0 facebook-clone-sandeep-morya.vercel.app\n0.0.0.0 sp10ct10-qunvek-biz-vumeni-kemra.pages.dev\n0.0.0.0 lpr47-145bf-mvk62-145sk-4b1c8d-lpr47-145c.pages.dev\n0.0.0.0 roomcaronmoons.sbs\n0.0.0.0 whatsapp-quickchat.vercel.app\n0.0.0.0 t-mobile.dvcqu.shop\n0.0.0.0 zarnel-privex-biz-holvik-santor-fdp1912.pages.dev\n0.0.0.0 customer-sp-hernandespule.pages.dev\n0.0.0.0 www.roblox.com.gr\n0.0.0.0 freelancer.id875422.shop\n0.0.0.0 121jio.senes.at\n0.0.0.0 www.prestamo-santander-cliente.vercel.app\n0.0.0.0 384734-apple.com\n0.0.0.0 ticket-cancel-apple.com\n0.0.0.0 xni4a-po4-tdup-fsl1r-08-09-2026-aa.pages.dev\n0.0.0.0 sp10ct10-kelvani-biz-zumrako.pages.dev\n0.0.0.0 xernqelo-mpt-belzavi-r6d9me35.pages.dev\n0.0.0.0 norzuni-mpt-qelmavo-c5x7fe83.pages.dev\n0.0.0.0 bdf88-132dr-lpr47-132lp-8b1c9d-lpr47-132a.pages.dev\n0.0.0.0 qnbkh-qpr-nnq3-zpy55-07-09-2026-hh.pages.dev\n0.0.0.0 zrob-skel-frip-184-prup-trandis-vug-753.pages.dev\n0.0.0.0 mail.ttkrewards.vip\n0.0.0.0 en-trezor-suite-io.square.site\n0.0.0.0 www.roblox.com.kz\n0.0.0.0 www.goo.su\n0.0.0.0 meetingdiscussion.weupdaa.workers.dev\n# END EXULTIA-OPENPHISH-2026-11-06\n" >> /etc/hosts

# Execute verification sentinel probe
log "Executing verification sentinel probe..."
if test -s /etc/exultia/blocklists/openphish-2026-11-06.domains && grep -q "BEGIN EXULTIA-OPENPHISH-2026-11-06" /etc/hosts && grep -q "^0.0.0.0 " /etc/hosts; then
  log "SUCCESS: Verification passed. UVI-2026-11-00000181 successfully mitigated."
else
  log "CRITICAL: Verification sentinel failed! Initiating emergency rollback..."
  sed -i '/# BEGIN EXULTIA-OPENPHISH-2026-11-06/,/# END EXULTIA-OPENPHISH-2026-11-06/d' /etc/hosts 2>/dev/null || true; rm -f /etc/exultia/blocklists/openphish-2026-11-06.domains /etc/exultia/blocklists/dns-sinkhole-2026-11-06.conf
  err "Rollback complete. System restored to baseline state."
fi