Carlos

Crawling 100M+ live business websites to measure how they quietly rot. 25 yrs Linux infrastructure. Machinist off the clock.

[Carlos @CrashCarlito]

I've been crawling business websites. About 116 million live sites so far.

Then I rechecked the ones that looked dead, a week later from two locations. Half came back. Single checks overstate decay about 2 to 1 seemingly due to bot checks & cloudflare type filters.

1 in 4 sites hasn't touched its footer in 3+ years.

Most of these sites have nobody watching them. I'll be posting what I find.

[Carlos @CrashCarlito]

Also new: I'm now tracking sites going from fine to down or hacked every night. First 10 hours: 6 confirmed outages, 0 confirmed defacements. Too early to blame PHP2Shell, but now I'll see it when it happens.

[Carlos @CrashCarlito]

PHP2Shell, day 2. I re-checked the same 8,775 small business sites I track that show their PHP version.

Yesterday 6.4% were on their branch's fixed release. Today it's 19.5%.

Real movement. Still 4 out of 5 not there.

[Carlos @CrashCarlito]

The hard part hasn't moved. 3,301 sites still show PHP 8.1 or older, which has no official fix. Only 92 of them jumped to a fixed release overnight.

If that's you, patching isn't an option. Upgrading or rebuilding is.

[Carlos @CrashCarlito]

@MikeTheTrader Wikipedia going dark to patch is the good outcome. The scary ones are the small business sites that never blinked yesterday because nobody's around to patch them. 41% of the ones I track that show a PHP version show 8.1 or older, which gets no fix.

[Carlos @CrashCarlito]

@vladozahradnik A lot. Of the small business sites I track that show their PHP version, about a quarter show PHP 7 or older, and 648 still show PHP 5. Most of them aren't kept alive on purpose. Nobody's left who remembers they exist.

[Carlos @CrashCarlito]

@calvinnwq Worth adding to #1: Amazon says it saw PHP2Shell attempts on Oct 17, four days before the patch. So "we patched Wednesday" isn't the end of it. Check logs and new admin accounts back to the 17th.

[Carlos @CrashCarlito]

@Dhanush_Nehru And most of the sites at risk have nothing visible in front of them. Of the small business sites I track showing PHP 8.1 or older, about 88% show no Cloudflare or similar. For a lot of them the only fix is an owner who has to call someone.

[Carlos @CrashCarlito]

@Amospikins Same trap one layer down: the host patched the box, the container still ships last year's PHP. Of the small business sites I track that show a PHP version, only 6.4% were on a fixed build on day 1. Rechecking today to see who moved.

[Carlos @CrashCarlito]

@VaibhavSisinty The eMudhra one has a deadline most site owners will miss: Chrome drops the emSign ECC Root CA G3 on Oct 27. If your site's certificate chains to it, it starts throwing errors that day. Worth a 30 second look at who issued yours.

[Carlos @CrashCarlito]

@RoundtableSpace The part that worries me: no fix exists for PHP 8.1 and older. Of the small business sites I track that show their PHP version, 41% show 8.1 or older. Those owners aren't patching this week. Most don't know what PHP is.

[Carlos @CrashCarlito]

Email spoofing risk is not evenly spread.

Share of working business websites I track where the domain can still be faked in email:

Beauty & wellness 92.7%
Food & drink 92.2%
Legal & finance 64.6%

Salons and restaurants are close to wide open. Law firms and finance shops do better, and most of them still aren't fully locked down.

If your business lives on Google reviews and phone calls, your domain name is doing unpaid work for whoever wants to fake an invoice from you.

[Carlos @CrashCarlito]

@eyanwebb @IvanPerezF_ True .. but when i was looking at PHP 4 version numbers earlier i realized my first encounters were in 2002 🤯

[Carlos @CrashCarlito]

@renebakx @jaydrogers Yep, that is what my research & leads try to solve.

[Carlos @CrashCarlito]

@renebakx @jaydrogers Yep, 100% agree .. going to be a bloodbath for old forgotten websites that were mis-managed

[Carlos @CrashCarlito]

@triplechaser @EmmettNaughton 5.4-8.1 are vulnerable and not officially patched

[Carlos @CrashCarlito]

@masadaboy48 @MrMaitra 💯

[Carlos @CrashCarlito]

Honest answer: a lot of them never will. Of the small business sites I track that show their PHP version, 41% are on 8.1 or older, and a quarter are on PHP 7 or older. For those, patching means jumping major versions. That breaks the old theme, the plugins and the contact form 10 different ways. Most will sit there until they get owned or rebuilt.

[Carlos @CrashCarlito]

@Sad_HAMs_ And attempting to upgrade PHP on your 10 year old website will break all sorts of plugins. 🫣