Hardening Legacy Linux Web Stacks Against PHP RCE

Overview When recent unauthenticated PHP RCE advisories dropped (targeting PHP_SESSION_UPLOAD_PROGRESS and oversized request bodies), I was in the middle of auditing several inherited Linux web servers I took over following a team retirement. While we work through a broader migration to move legacy workloads onto fresh, Terraform-managed infrastructure, I wanted to immediately reduce our PHP attack surface and add defense-in-depth controls across the existing hosts—without causing production downtime. Because I was working across live systems that lacked a 1:1 staging twin, I leaned heavily on Claude Code and AWS Systems Manager (SSM) to orchestrate the discovery, build hash-checked apply/rollback scripts, and run an automated curl verification suite after every change. Here is how we locked the environment down.