Frp

A parish church website was running on a single cloud droplet with a stack that had quietly gone end-of-life: PHP 7.3, WordPress 6.6.2, MariaDB 10.4. That part is common. What made it urgent was the 2026 “php2shell” set of pre-auth PHP remote-code-execution vulnerabilities (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). On a supported PHP there is a patch. On PHP 7.3 there is no patch, because 7.3 is past end-of-life and upstream stopped shipping fixes. The only real remediation was to get off that stack entirely.

The last big cloud holdout I had was a Django site on an AWS EC2 box. You are reading this one, the Hugo site, from the same desk now - but dtac.io was the one that had an actual database in it. That made it the interesting one. This article is the record of dragging a real, stateful web application off a rented VM and onto the little cluster sitting next to my keyboard.