Server Rules for the November 2026 Security Patch

These rules block the flaw described on the security patch page at your web server. Use them if you can’t patch yet, or if you’re on nginx, or on Apache that doesn’t read .htaccess files. On shared hosting, where you can’t change the server configuration, use the shared hosting rules.

Each set does two things: it stops PHP from running in osta/uploads/, and it limits choose-theme.php to your own IP address. Nobody else can save theme settings while this is in place. Replace 203.0.113.10 with your IP address.

These rules are a stopgap, so please still apply the patch. On nginx, or Apache without .htaccess, keep the first rule after patching. The second can then go.

Apache

Add this inside your site’s VirtualHost block (Apache 2.4), then restart Apache. It works whatever your AllowOverride setting is:

<LocationMatch "/osta/uploads/.*\.(php[0-9s]?|phtml|pht|phar)(\.|/|$)">
    Require all denied
</LocationMatch>
<LocationMatch "/osta/css/themes/choose-theme\.php">
    Require ip 203.0.113.10
</LocationMatch>

Ubuntu and Debian

Apache on Ubuntu and Debian ignores .htaccess files by default, so the file included in the patch has no effect until you turn them on. If your osTicket folder isn’t /var/www/html, change that line to match:

sudo tee /etc/apache2/conf-available/osticket-htaccess.conf <<'EOF'
<Directory /var/www/html>
    AllowOverride All
</Directory>
EOF
sudo a2enconf osticket-htaccess
sudo a2enmod rewrite
sudo systemctl restart apache2

Once this is on, the .htaccess file in osta/uploads/ stops PHP from running there. Keep this setting after you’ve patched.

Shared hosting (Apache or LiteSpeed)

If you can only upload files, use .htaccess. Your host must have .htaccess files and rewrite rules turned on, which most do. If you’re not sure, test as shown below.

Put this in osta/uploads/.htaccess, replacing what’s there:

RewriteEngine On
RewriteRule \.(php[0-9s]?|phtml|pht|phar)(\.|/|$) - [F,NC]

Then create osta/css/themes/.htaccess with this, writing your IP address with a backslash before each dot:

RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^203\.0\.113\.10$
RewriteRule ^choose-theme\.php - [F]

Remove osta/css/themes/.htaccess after you’ve applied the patch. If your site sits behind a proxy or CDN, delete the RewriteCond line, which blocks everyone until you remove the file.

nginx

Add this directly inside your site’s server block, not inside a location, because a PHP location can otherwise match first. Then run nginx -t and reload nginx. This also works in Plesk, under Additional nginx directives.

if ($uri ~* "/osta/uploads/.*\.(?:php[0-9s]?|phtml|pht|phar)(?:[./]|$)") {
    return 403;
}
set $osta_ct "";
if ($uri ~* "/osta/css/themes/choose-theme\.php") {
    set $osta_ct "1";
}
if ($remote_addr != "203.0.113.10") {
    set $osta_ct "${osta_ct}2";
}
if ($osta_ct = "12") {
    return 403;
}

Behind a proxy or CDN such as Cloudflare, nginx sees the proxy’s address rather than yours, so the IP check can’t work. Block choose-theme.php for everyone by replacing the last three if blocks and the set line with:

if ($uri ~* "/osta/css/themes/choose-theme\.php") {
    return 403;
}

Windows IIS

Add this to the web.config in your osTicket folder, inside <system.webServer>. It blocks choose-theme.php for everyone, including you, until you remove it. If your site already has a requestFiltering section, add these lines to it.

<security>
  <requestFiltering>
    <denyUrlSequences>
      <add sequence="choose-theme.php" />
    </denyUrlSequences>
  </requestFiltering>
</security>

Then create osta/uploads/web.config with this content:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <security>
      <requestFiltering>
        <fileExtensions>
          <add fileExtension=".php" allowed="false" />
          <add fileExtension=".phtml" allowed="false" />
          <add fileExtension=".phar" allowed="false" />
        </fileExtensions>
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

Test the rules

From a device on a different network, such as a phone with Wi-Fi turned off, open these two addresses on your helpdesk:

• /osta/css/themes/choose-theme.php
• /osta/uploads/test.php

Both should show a 403 Forbidden error (IIS shows a 404). If /osta/uploads/test.php shows 404 on Apache, nginx or LiteSpeed, your rule isn’t working yet, because the request reached the folder. Then check that your logo still appears and that your helpdesk opens normally.