Kyle Clouthier

Dad ┆ Ottawa Valley ┆ I build web apps and websites, then bring the customers ┆ 20 years in sales ┆ B2B lead gen┆

[Kyle Clouthier @ClouthierBuilds]

PHP's critical flaw leaked before the patch. Exploit code was out before the fix was.

So I built a free checker this morning.

Drop your URL. If you're on PHP 8.1 or older, there is no patch coming. Ever.

https://t.co/lRbVw5GgFX
#php2shell

[Kyle Clouthier @ClouthierBuilds]

@FelipeDaragon For site owners skimming: per Syhunt's own repo, this is a lab setup needing unusual session settings plus a weakness in the app, not a bypass of the Oct 21 fixes. Keep the update installed, and turn off session.upload_progress.enabled at server level if unused.

[Kyle Clouthier @ClouthierBuilds]

@FrontlineTalks Agreed, and it's usually the slowest part. Before anyone can even see the PHP version, someone has to find the hosting login, and on older sites that often means digging through old emails or chasing down the old web guy. The patch is the easy bit after that.

[Kyle Clouthier @ClouthierBuilds]

BambooHR just took itself offline in Canada, the US and Ireland over PHP2Shell. Payroll interrupted. No restore time.

That's a company with a security team.

Now picture every small business site on cheap hosting still running PHP 8.1. There's no update for them to install.

[Kyle Clouthier @ClouthierBuilds]

@ATown_Jonesy Straight from the checker. An IT team ran their own site, saw the result and hit "email me this report", so it started with their site, not a pitch. Day 2 now: over 1,500 checks and still just that one real lead, so I'm working on making that step easier.

[Kyle Clouthier @ClouthierBuilds]

Day 1 #buildinpublic:

Shipped a free PHP2Shell checker this morning, a few hours after the emergency patch dropped.

643 sites checked
30 of the 83 that show their PHP version are end of life
A GitHub Action, now on the Marketplace
First lead came in tonight

https://t.co/OgQk1gKTqW

[Kyle Clouthier @ClouthierBuilds]

@AISafetyMemes @NickADobos Of this list, PHP2Shell is the one a small business can act on today. Ask whoever runs your website one question: which PHP version is it on? Only 8.2 to 8.5 got fixes. On 8.1 or older there is nothing to install, and those sites stay open until someone upgrades them.

[Kyle Clouthier @ClouthierBuilds]

@RoundtableSpace For owners who have never opened a terminal, same idea in the browser, nothing to install: https://t.co/lRbVw5GgFX

And if your server hides its version (the UNKNOWN case), you can pick it by hand for an exact answer. WordPress shows it under Tools, Site Health, Info, Server.

[Kyle Clouthier @ClouthierBuilds]

@deedydas Which is why this one can't wait for a quiet week. Two checks for anyone with a site: is PHP on 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and was PHP restarted after the update? Skip the restart and the old version keeps serving requests.

[Kyle Clouthier @ClouthierBuilds]

@coinbureau The part most site owners miss: only PHP 8.2 to 8.5 got official fixes. If your site runs 8.1 or older, there is no update to install, only a version upgrade. Worth asking your host one question today: which PHP version is my site on?

[Kyle Clouthier @ClouthierBuilds]

@eastdakota @Cloudflare On the owner side, the worry is what can't be patched. Of 135 people who looked up their exact PHP version on our free checker, 55 are on 8.1 or older, where there is no official fix to install at all.

https://t.co/lRbVw5GOvv

[Kyle Clouthier @ClouthierBuilds]

@NSACyber First step for any site: find out which PHP version it runs. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. 8.1 and older get no official release at all.

Free check, no attack traffic: https://t.co/lRbVw5GgFX
On the server: https://t.co/dwEuGCMmQ4

[Kyle Clouthier @ClouthierBuilds]

If the script or the Action saves you time, a star on GitHub helps other devs find it: https://t.co/dwEuGCMmQ4

[Kyle Clouthier @ClouthierBuilds]

Ottawa's Dev Inception wrote up my free PHP2Shell checker today. Their point: one check isn't enough, your build should block unfixed PHP.

Write-up: https://t.co/xgihmGTsej
Checker: https://t.co/lRbVw5GgFX
Action: https://t.co/hYP7CrQf6T

#PHP2Shell #DevInception #Ottawa

[Kyle Clouthier @ClouthierBuilds]

@hints_crypto @realObsidJan Danke! Lieber ein paar Stunden offline als ein offener Server. Gut zu wissen, dass Netcup so konsequent war.

[Kyle Clouthier @ClouthierBuilds]

@gavinelliott Thanks Gavin. Day 2 numbers: 1,393 checks, 1 real lead. Traffic was the easy part. Now working on turning a bad result into a conversation.

[Kyle Clouthier @ClouthierBuilds]

@clubmini1 For a lot of small sites that's the real fix. Two questions worth sending any host: which PHP version am I on, and when did you patch this week? A good host answers both in one email.

[Kyle Clouthier @ClouthierBuilds]

@Anoyroyc That's the idea. A one-time check tells you about today. The Action fails the build if a project ever pins an unfixed PHP version, so it can't quietly slip back. Free on the Marketplace: https://t.co/hYP7CrQf6T

[Kyle Clouthier @ClouthierBuilds]

Day 2 building in public.

22 hours in: 1,393 checks on my free PHP2Shell checker. 67 sites on PHP that will never get an official fix.

Lesson: in a crisis, traffic is easy. Leads aren't. 1 so far. Live chat goes in next.

https://t.co/lRbVw5GgFX

#buildinpublic #PHP2Shell

[Kyle Clouthier @ClouthierBuilds]

France's data protection regulator, CNIL, still shows this maintenance page today, a day after the PHP2Shell fix shipped. The Dutch regulator's site isn't answering at all.

A public tracker lists 50 sites that went dark during the scramble. 47 are back.

If the regulators are still working on it, check your own site: https://t.co/OgQk1gKTqW

#PHP2Shell #CyberSecurity

[Kyle Clouthier @ClouthierBuilds]

Igor's full article: https://t.co/snlApcAMQa

Free checker: https://t.co/lRbVw5GgFX

[Kyle Clouthier @ClouthierBuilds]

A security director in Stockholm added my free PHP2Shell checker to his briefing for European CISOs as the "eighth net": run it across every domain you have ever registered, including the forgotten ones.

Thank you Igor van Gemert. Article below.

#PHP2Shell #CyberSecurity

[Kyle Clouthier @ClouthierBuilds]

The NSA has put out its own PHP2Shell advisory. Three lines matter most for small business sites:

1. Inventory everything that relies on PHP
2. Replace end-of-life PHP that can't be patched
3. If you can't update right away, take the site offline

See which PHP version your site runs, free: https://t.co/OgQk1gKTqW

#PHP2Shell #CyberSecurity