How a startup’s cloud got taken over by a simple form that sends emails

This report recounts an SSRF-based compromise where a PHP image-fetching function (file_get_contents) was used to access the EC2 metadata endpoint (IMDSv1), exposing IAM role credentials that allowed the attacker to read S3 buckets and sensitive environment/cloudformation secrets; recommended defenses include migrating to IMDSv2, removing secrets from server environments, and adding IAM conditions (e.g., VPC endpoint restrictions).