Conversation

Disabling any request body processing with #Vinyl_Cache to avoid the #php RCE is simple:

sub vcl_recv {
if (req.http.Content-Length || req.http.Transfer-Encoding) {
return (synth(403, "No req body"));
}
}

With vmod_re, you acn also specifically match contents: https://vinyl-cache.org/tutorials/body_regex.html#search-client-request-bodies-in-vcl-recv

This might become useful once specific patterns indicating attack vectors become known.