Securing VPS hosts for self-hosted personal agents
Citing two critical PHP flaws, the post argues self-hosted personal agents like OpenClaw and Hermes should be taken off the public internet, with Tailscale, SSH hardening and a firewall.
PHP2Shell is a wake-up call for VPS security. and if you're deploying personal agents, this one is for you: PHP powers a huge part of the web, and this week two critical flaws in it leaked before they were meant to go public. they let anyone send a specially crafted request to a server and run their own code on it, without ever logging in. within days, bots were scanning the internet for servers to try it on. those bots aren't only looking for PHP, either. they scan every public server around the clock, hunting for anything left open. a website can't hide from that, because it has to accept traffic from the public. its only real defense is patching fast. this matters a lot right now, because so many people are running their own personal agents like OpenClaw and Hermes, often on a cheap VPS so they stay online 24/7. the good news is that a personal agent is different from a website. it doesn't need to accept a single connection from the public internet, which means you can take its server off the internet entirely. and you have good reason to, because that server holds a lot. your LLM API keys, your connected accounts, and an agent that can run shell commands all sit there, so one open port gives an attacker far more than a website ever would. i walked through exactly how to do this in a video a few months back, and it's just as relevant today for any agent you self-host. here are the three sections that matter most: 12:13 - Tailscale: making your server invisible to the internet 14:52 - locking down SSH + creating a non-root user 19:39 - firewall: blocking everything except Tailscale before you lock it all down, turn off key expiry on the server's Tailscale node and keep your cloud provider's web console handy as a backup way in, so you never lock yourself out.