Plex2Shell and PHP2Shell hit home servers in one week. What 11 Docker images really ship, which ports to close, and how to go VPN-only.