An Unpatched RCE on a Church Website: Moving It Off an End-of-Life Host
A parish church website was running on a single cloud droplet with a stack that had quietly gone end-of-life: PHP 7.3, WordPress 6.6.2, MariaDB 10.4. That part is common. What made it urgent was the 2026 “php2shell” set of pre-auth PHP remote-code-execution vulnerabilities (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). On a supported PHP there is a patch. On PHP 7.3 there is no patch, because 7.3 is past end-of-life and upstream stopped shipping fixes. The only real remediation was to get off that stack entirely.