OSSEC / HIDS Rule 30302

OSSEC / HIDS rule catalog

• Rule family: OSSEC / HIDS
• Rule ID: 30302
• Definition status: Present in current source
• Alert message / subject: Self Healing: Critical vulnerability in PHP detected, attempting to remove dangerous exec stack bits from PHP modules.
• Rule level: 8
• Definition checked: 2026-10-21

Interpretation and response

The rule reports an attempt by legacy ASL self-healing functionality to remove executable-stack markings from PHP modules. Check the underlying event and application compatibility.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

This event reports an attempted action, not proof of a completed repair or a confirmed exploit. Use supported vendor guidance before modifying application binaries.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

The rule reports an attempt by legacy ASL self-healing functionality to remove executable-stack markings from PHP modules. Check the underlying event and application compatibility.

Log examples

Illustrative event summary (not a captured log): OSSEC/HIDS 30302 — Self Healing: Critical vulnerability in PHP detected, attempting to remove dangerous exec stack bits from PHP modules..

Troubleshooting

False Positives

None. This event is not generated or caused by ASL in any way. This is a reporting rule, it simply reports when PHP is detected in this vulnerable condition, and attempts to fix it. It does not cause the segmentation fault. The rule detects when the segmentation fault occurs.

Guidance

Please contact your PHP vendor for assistance with removing this vulnerability should ASL not be able to remove it. Please see the php segfaults (historical reference) FAQ for additional information for assistance with correcting this vulnerability.

Additional Information

Notes

If PHP has this vulnerability, it will segfault when it tries to run, as the ASL kernel will protect itself from this vulnerability in PHP and PHP will die out because it can not punch this hole into the system. The specific vulnerability is that PHP, or one of its modules, will try to configure itself to allow the kernel “stack” to be executable. This is both unnecessary for PHP or its modules to function, and creates a root level hole in the system making it possible for an attacker to inject code right into the kernel “stack”, running whatever code they want on the system and thereby compromising the entire system.

Source and revision

Migrated from HIDS_30302, wiki page 426, revision 4047 (20131010). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .