Mirror operation, outgoing connections / OUTPUT firewalling?

Dear PHP mirror infrastructure maintainers / fellow mirror operators,

in the light of the rumors (on internals) that some php.net machines 
have been compromised, probably by recent shellshock attack vectors 
(guess guess...), we could maybe worry a bit about what this might 
mean for our mirror operation.

Apart from securing / patching our own machines, which seem CGI-free 
anyway and thus probably not directly attackable, there is the 
hypothetical hack to the php scripts that we rsync in to provide our 
php.net mirrors, and what such a hacked code might do (send spam, try 
to attack other systems, maybe ones internal to our operation that are 
not reachable from the outside, ...)

In light of this, I am thinking about setting up, on my mirror machines 
and maybe in addition in-front-of-them, an OUTPUT iptables ruleset that 
is very restrictive in what outgoing connections to permit.

We'll obviously need DNS, maybe unrestricted because webalizer.

We'll also need to permit rsync (TCP 873) outgoing to the rsync source 
we use, but to nowhere else.

Main question: is there anything else done by the php.net mirror .php 
scripts themselves on the mirrors, that makes OUTPUT connections, 
and would need to be permitted in such a restrictive setup?

best regards
  Patrick