> because it wasn't actually running PHP

Yea and no, I mean it was an even worse setup than typical, probably because the person setting it up didn’t have php experience or used an LLM that misinterpreted “route requests from nginx to php” or something too literally and set up a hacky solution.

But my impression isn’t that they set it up in some cheeky way to avoid exploits, it looks like they just asked for nginx to be in front.

And is “hacked in two hours” fair if they had to make it easy for people because their noob setup ended up not being exploitable?

Let me know if my read of what happened is wrong.

It was serving static html https://news.ycombinator.com/item?id=50224916#50234806