Wasn't going off the article: I saw the SSH stuff last month and had double-checked I had all remote-access off on my config.

Then when I saw the latest story this morning, I ran an nmap that showed webfig was still exposed on my pub IP. Probably just due to some automatic bridging behavior that bit me, but I'll have to confirm later.