title: Server crash after seemingly malicious user agent
body: <p>I am running Ubuntu with Plesk Onyx. This comes with nginx as the proxy, and Apache with varying options of PHP.</p>
  
  <p>I woke to find that the websites hosted on the server were returning 502 Bad Gateway.</p>
  
  <p>Looking at the logs, one of the websites had a very strange user agent and referrer:</p>
  
  <pre><code>() { :;}; echo; echo \x22f5d463ef8e86a21c440eccc11b308080\x22
  </code></pre>
  
  <p>The issue resolved itself with a server restart, but the websites were still down during this time.</p>
  
  <p>Seems like a pretty dangerous exploit. I'm looking for ideas on preventing this at any level (at Plesk, at NGINX, firewalls or other methods). Thank you.</p>