If anyone is following standard "recommended" practice, like in Nextcloud case, they get burned. This is true for all languages and frameworks. If you dont pra

If anyone is following standard "recommended" practice, like in Nextcloud case, they get burned. This is true for all languages and frameworks. If you dont practice defense-in-depth, you get rekt eventually. I just checked my installation, its safe, since I didnt follow their "recommended" settings at all. Since its a PHP app, what I do is put an extra nginx proxy infront of it, so there is nginx 1 (this one runs in its own lxc container with seccomp and has not even a /bin/sh in it, only executables and libc required for nginx, its only a network reverse proxy) - nginx2 (special instance for each php app, also same as nginx1 container with _nothing_ in it, but also a bind mounted ipc_socket which is also mounted to php_app container. So the php_app container and nginx2 share only 1 ipc.socket bind mounted from the host. Now then, in the php app container, there is also lack of /bin/sh or anything else, not even the package manager, only what php-fpm requires, and the nextcloud .php scripts, are in there. _nothing_ else. So even if this exploit would have worked, there would still be nothing standard to run in the php-app container (like /bin/ls), except the php scripts themselves, though thats bad enought to steal my nextcloud data.