[yolte]

Originally Posted by Tony

I'd say more like a site can be hacked because they do not keep up to date versions of their software or make secure software. For hacking an entire server it be even more tricky assuming the site was on it's own account.

I think we have to protect customers web sites who doesn't have enough information about script security?

There are other mod_security rules which are already supported which can inflate memory (ones that use location match). I'd rather see the rules that are supported not slow down LSWS to Apache levels.

Can you give me examples which rules are protecting from php shells? (for ex: r57, c99)