php security on a system with only known php software (or: need alternative non-PHP CMS)
listed in answer
ANSWER:
You mention that you have a restricted firewall in place – don’t forget you can block outgoing connections by UID.
If you’re running PHP under its own user ID you can (& should!) deny that user outgoing HTTP/HTTPS connections unless you need to allow for update checking or RSS feed fetching. This will prevent any exploited code from being able to download a rootkit.
New Comments