Yeah, we have one legacy, abandoned PHP service that isn't readily updatable and is being replaced, so in the interim it runs fully isolated in its own VPC with only Cloudflare able to reach it to help protect it. The container runs non-root with read-only filesystem and the host has no egress allowed at all for the UID running the service (not even DNS, no new outbound traffic for that UID at at all), it can only be connected to by CF's hosts.
It has survived perfectly fine so far and is on a _very_ vulnerable PHP version based on the php2shell writeup. Management knows it could supposedly get popped at any time, and we'd have to rollback to a snapshot, spin it back up, and wait for it to get popped again. Rinse/repeat.
It has survived perfectly fine so far and is on a _very_ vulnerable PHP version based on the php2shell writeup. Management knows it could supposedly get popped at any time, and we'd have to rollback to a snapshot, spin it back up, and wait for it to get popped again. Rinse/repeat.