A note to our neighbours · Southern Tasmania

THE INTERNET
IS ON FIRE.

Your business doesn't have to be.

10 local businesses. Free, personally reviewed website exposure checks.

Request a free check What to ask your provider

No bullshit. No obligation. An enquiry doesn't reserve a place.

The internet has had an absolute shocker. Critical flaws in PHP, the software underneath many websites. A poisoned update to an AI tool. Ordinary businesses have better things to do than follow all this. Unfortunately, running a café, orchard or workshop doesn't make the problem disappear. Your website might be fine. Let's establish what we can actually verify — and what your hosting provider needs to answer.

What the hell happened?

01 / THE WEBSITE SOFTWARE

PHP2Shell: check the engine, not just the paintwork.

Confirmed: PHP's 21 October advisory describes two flaws, CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated attacker run code on a server. They involve memory corruption and stale internal state across requests.

Who should check: businesses whose websites use PHP, including many content-management systems. PHP says installations serving web requests are at risk; it rates Apache mod_php highest, with a demonstrated attack before application code runs. Actual exposure depends on the runtime, host and configuration. This does not mean every PHP website is compromised.

Useful action: ask your host to verify the actual PHP runtime. The fixes released on 21 October are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A vendor may backport fixes, so a version string alone is not proof either way. Older branches need vendor confirmation or an upgrade to a supported release.

PHP added a further warning on 23 October about an unusual combination of session configuration and application code. Ask your host to check that too. Updating plugins and themes alone doesn't establish that the runtime is patched.

Read PHP's security advisory →

02 / THE SUPPLY CHAIN

A legitimate update channel. An illegitimate update.

Confirmed: LiteLLM says its 1.107.0 release on 21 October contained credential-stealing malware. Its later investigation traced the attack through an exposed, unrevoked key, stolen GitHub access and a subverted release process.

Who might be affected: operators who installed or ran the affected Python package or container images. This is an AI infrastructure incident; an ordinary business website isn't automatically affected because it exists online.

Useful action: if your provider uses LiteLLM, ask them to check the exact installed artifacts against the incident report and follow its response guidance. Installing a clean update alone doesn't undo stolen credentials.

Read the corrected investigation →

Being patched today doesn't prove you weren't exposed yesterday. It also doesn't prove there was a compromise. Those are different questions, and they need different evidence.

Three questions for your website provider

1. Are we running affected software?
For PHP2Shell, has the actual PHP runtime been checked and updated — as well as the website's plugins and themes? Somebody should know what's running underneath your website.
2. Were we exposed before it was patched?
What evidence exists of exploitation or compromise? Have relevant logs and alerts been reviewed? What can't be established from the records available?
3. Who is responsible if something goes wrong?
Who manages hosting, backups, security updates and incident response? Has recovery been checked? Can you reach the responsible person when it matters?

Send this to your provider

Hi, I've seen the recent PHP2Shell security advisories (CVE-2026-109618 and CVE-2026-109619). Could you confirm whether our website or hosting uses an affected PHP runtime, whether the relevant patches have been applied, whether there is any evidence of earlier compromise, and whether our backups and recovery process have been checked? Please also check PHP's 23 October session upload progress advisory. A short written update would be appreciated. Thanks.

You can also select the message above and copy it into an email. No registration needed.

10 local businesses. Free exposure checks.

The first ten eligible businesses receive a personally reviewed initial website exposure assessment, with a short written report in plain English.

Publicly observable website and hosting characteristics.
Relevant recent advisories and potential exposure.
Obvious externally visible configuration problems.
Questions only your hosting provider can resolve with evidence.
Prioritised next actions to take back to your developer or provider.

Genuinely free. No obligation. No purchase required.

This is an initial external review, not a full penetration test, forensic investigation, compliance certification or guarantee of security. No exploit attempts or intrusive testing are included.

Who it's for

Businesses in the Huon Valley and southern Tasmania with a public website. Sole traders, family businesses and small not-for-profits are welcome. I'll confirm local eligibility and your authority to represent the website by email. No website yet? The local services page is a better starting point.

Eligible places are allocated in the order enquiries arrive, after review. Duplicate enquiries don't get extra places. I'll confirm an award in writing; submitting an enquiry doesn't secure one. The ten-place limit includes completed assessments.

This free review is separate from my paid business diagnostic and implementation work. It isn't a first step you must take towards buying anything.

What you'll receive

Illustrative example · fictional business

Initial website exposure review

Example Orchard · example.invalid
Example assessment date: 25 October 2026

Observed: Public site served over HTTPS. Underlying PHP runtime version not externally verifiable. Hosting ownership not yet confirmed.
Potential concern: PHP2Shell exposure cannot be ruled in or out from public observations.
Next action: Ask the hosting provider to confirm the PHP runtime, patch status and relevant log review.
Confidence and outcome: Limited by external-only access. Provider verification required; no conclusion of compromise.

An unanswered question is not a confirmed vulnerability. A lack of visible problems is not a security certificate.

Request a free check

Email me using the draft below. Include your business name, public website URL, town or suburb, contact name and email, and confirmation that you own or are authorised to represent the website. A short concern is optional.

Please don't send passwords, API keys, hosting credentials, customer records, payment details or sensitive files.

Open an email draft

This opens your email app. You still need to complete and send the email. Nothing has been submitted by clicking. If it doesn't open, email [email protected] with the subject “ON FIRE — free website exposure review”.

Show the application text to copy

Hi Adrian,

I'd like to request the free initial website exposure review.

Business name:
Public website URL:
Business location (town/suburb):
Contact name:
Contact email:
Optional concern (no sensitive details):

Authority: [Please confirm: I own or am authorised to represent this website.]

I understand this is an enquiry, not an awarded place, and that the review is external and non-invasive.

I'll reply to confirm receipt and check eligibility. A place is awarded only when I confirm that separately in writing. If you haven't heard back within three business days, follow up by email. Please keep any follow-up in the same thread.

Enquiry information is used to check eligibility, allocate places and deliver the review. It is held in my Google-hosted email account and a private local campaign record, accessible to me and the providers operating that infrastructure. Participant identities and findings aren't published or added to marketing lists. Campaign records and assessment correspondence are scheduled for deletion 90 days after the offer closes, unless you ask me to retain them or a legal requirement applies; provider backups may take longer to expire. Privacy details and deletion requests.

I'm Adrian. I'm in Cygnet.

I build and investigate software systems, from local business tools to adversarial testing of AI. My work spans cybersecurity, reliability and finding out what systems actually do when things go wrong. This is me offering a bounded piece of useful work to my neighbours.

More about my background · Adversarial evaluation work · Local services

Sources and updates

Prepared: 25 October 2026. Last reviewed: 25 October 2026. Published: 25 October 2026.

Advisories can change. These dates record an editorial review, not an automatic refresh. The later LiteLLM investigation corrects parts of its initial explanation. Spotted something outdated? Email a correction.

THE INTERNET IS ON FIRE.