https://www.dannoprojects.com/tags/security/Recent content in Security on Danno ProjectsHugo -- gohugo.ioenTue, 27 Oct 2026 12:00:00 -0700https://www.dannoprojects.com/posts/security/hardening-legacy-linux-web-stacks/Tue, 27 Oct 2026 12:00:00 -0700https://www.dannoprojects.com/posts/security/hardening-legacy-linux-web-stacks/<h2 id="overview">Overview</h2> <p>When recent unauthenticated PHP RCE advisories dropped (targeting <code>PHP_SESSION_UPLOAD_PROGRESS</code> and oversized request bodies), I was in the middle of auditing several inherited Linux web servers I took over following a team retirement.</p> <p>While we work through a broader migration to move legacy workloads onto fresh, Terraform-managed infrastructure, I wanted to immediately reduce our PHP attack surface and add defense-in-depth controls across the existing hosts—without causing production downtime.</p> <p>Because I was working across live systems that lacked a 1:1 staging twin, I leaned heavily on <strong>Claude Code</strong> and <strong>AWS Systems Manager (SSM)</strong> to orchestrate the discovery, build hash-checked apply/rollback scripts, and run an automated <code>curl</code> verification suite after every change. Here is how we locked the environment down.</p>