What's with the weird activity in the Nginx logs?

Question

linux

Tell me, what is this strange activity in the Nginx logs?

GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1

Answer 1

Attempts to start debugging.
Attempts to perform code injection.
General hacking attempts.

Answer 2

Standard Internet noise - crawlers, vulnerability scanners ...
In general, you don't need to do anything, except for situations when they purposefully hammer with the same type of requests - then you can set up blocking by IP addresses, for example, using fail2ban, etc.

Answer 3

Bots check your site for vulnerabilities. They do this all the time - they scan the sites found on the network, somewhere they will find something useful for themselves.

Answer 4

These are bots from hacked servers prowling in search of vulnerabilities. The main thing here is not to store backups in a public directory and close access to all files and folders that are not planned to be accessed from a browser (relevant for typical cms in which everything is just in a public directory).

[error] 17767#17767: *563416 access forbidden by rule, request: "GET /.git/config HTTP/1.1"
[error] 17767#17767: *630497 access forbidden by rule, request: "GET /vendor/phpunit/phpunit/build.xml HTTP/1.1"
[error] 17767#17767: *646466 access forbidden by rule, request: "GET /backup/.env HTTP/1.1"
[error] 17767#17767: *646516 access forbidden by rule, request: "GET /backup/.env HTTP/1.1"
[error] 17767#17767: *647060 access forbidden by rule, request: "GET /vendor/.env HTTP/1.1"
[error] 17767#17767: *647087 access forbidden by rule, request: "GET /vendor/laravel/.env HTTP/1.1"