PHP Defense in Depth After PHP2Shell What an engine-level PHP bug teaches about hardening: the settings that matter when the attacker is already executing machine code inside your worker.