@stefano There are lots of topics and classics in this story!

A WP plugin allowed remote code execution, it uses unmonitored autoscaling in the cloud, and dev team decides "we need moar power!". Classics on top of classics!

I believe this have to happen like every day around the world.

Now, I'd like to point that is not that Alpine/Linux is less secure than FreeBSD. It's just more popular, so vulnerable WP plugins execute Linux binaries if they can.

I am a firm defender of both cloud and self-host. In one hand, It's very hard to have the physical security and electrical/network redundancy of an actual datacenter. On the other hand, no cloud provider will offer truly data ownership, sovereignty and vendor independence . So, both approaches have their places.

I've seen AWS billings that would buy very nice hardware, every month. And salaries of "cloud experts" are no cheaper that old-school sysadmins. Specially if you have to pay their cloud certifications too.

I hope that manager learned the lesson.