Mirror operation, outgoing connections / OUTPUT firewalling?

Dear PHP mirror infrastructure maintainers / fellow mirror operators, in the light of the rumors (on internals) that some php.net machines have been compromised, probably by recent shellshock attack vectors (guess guess...), we could maybe worry a bit about what this might mean for our mirror operation. Apart from securing / patching our own machines, which seem CGI-free anyway and thus probably not directly attackable, there is the hypothetical hack to the php scripts that we rsync in to provide our php.net mirrors, and what such a hacked code might do (send spam, try to attack other systems, maybe ones internal to our operation that are not reachable from the outside, ...) In light of this, I am thinking about setting up, on my mirror machines and maybe in addition in-front-of-them, an OUTPUT iptables ruleset that is very restrictive in what outgoing connections to permit. We'll obviously need DNS, maybe unrestricted because webalizer. We'll also need to permit rsync (TCP 873) outgoing to the rsync source we use, but to nowhere else. Main question: is there anything else done by the php.net mirror .php scripts themselves on the mirrors, that makes OUTPUT connections, and would need to be permitted in such a restrictive setup? best regards Patrick