3
This isn't a sign of anything to be concerned about.
As a general rule of thumb you should expect to find all kinds of strange URLs in your logs. This is the normal "background noise" of the internet. In essence, shortly after a server becomes accessible to the internet, automated bots will automatically start scanning it for any number of well known ...
2
Considering PHP v5.3 and v5.6 are end of life for a while, no more patches, (security) fixes or updates will become available even if security issues are discovered.
Your hosting provider is quite late in removing these PHP versions considering v5.6 is end of life since December 31st, 2018.
So, can we say it is "fairly safe" to run an outdated PHP ...
1
like the documentation of password_hash states, a unique salt is being calculated for each time it is called.
It is strongly recommended that you do not generate your own salt for this function. It will create a secure salt automatically for you if you do not specify one.
(source: php manual - password_hash)
Additionally the used options of the hashing ...
1
You handle the upload with POST requests to a PHP script which checks the file extension and renames the file
You should check the mime type. PHP have mime_content_type function for that. Even if it's possible to fool the mime header and have some code on the metadata of the file, this raises the bar for exploiting your system.
If I understand correctly, ...
1
Even though you developed your code with security and privacy by design, audited the result and have continuously monitored CVEs to be sure that there are no (known) issues that affect you, that doesn't mean everyone else has, too. Presumably you're in a shared hosting or VPS environment: your hosting company is in the business of providing a secure OS, ...
1
Always try to use the minimum permissions required to do the job, like this you can protect against current and unknown threats. With this in mind, there are three requirements that can be extracted from your explanation:
john needs to be able to read and edit the files
www-data needs to be able to read the files
Other users on the system have no business ...
Only top voted, non community-wiki answers of a minimum length are eligible
