The Websites You Forgot About Are Now Your Biggest Risk

PHP2Shell won't reach you through your bank. It will reach you through the hobby forum you joined in 2014.

Think back. The knitting forum. The football fan site. The little online shop that sold you a phone case in 2016. The school reunion page. The local club that made you create an account to book a court.

You probably forgot about them years ago. Your email address, your name, maybe your home address and an old password are almost certainly still sitting on their servers.

This week's PHP flaw, a critical cyber-security flaw in the PHP programming language, is mostly being told as a story about governments switching websites off and AI finding bugs. For ordinary people, the more useful way to see it is this: the sites most likely to stay broken are exactly the ones you've forgotten you use.

What Happened: The PHP Flaw in Brief 

On 21 October, the makers of the PHP programming language, the hidden software that builds the pages of a huge share of the world's websites, announced a serious PHP flaw nicknamed PHP2Shell. It lets a stranger take control of a website's server without any password (NCSC). Criminals started trying it before the fix was even public (AWS).

A fix exists. But it only helps a website if someone installs it on the server, and the official fix only covers recent versions of PHP (Brandefense).

Why the Big Names Aren't the Main Worry

 Your bank, your email provider and the giant shopping sites have security teams who read these warnings within minutes. The councils and government bodies that switched their sites off this week, such as Oxford, Edinburgh and the UK's budget watchdog, were doing the cautious thing (Yahoo/PA). A website that goes dark for a day is a website someone is looking after.

The ones to worry about are the sites that stayed online, unchanged, because nobody was there to notice.

The Forgotten Web 

The internet is full of small sites that were built once and then left alone: a club page a volunteer set up, a shop whose owner moved on, a forum still running years after its last post. These sites tend to run old versions of PHP, and old versions are exactly the ones that did not get an official fix.

The numbers are striking. Of the PHP servers that reveal which version they run, about 59% are on a version with no official fix (CybelAngel). Among WordPress sites, the most popular way to build a small website, about 35% run a PHP version that is no longer patched.

And the fix can't be applied by clicking "update" inside the website. It has to be done on the server, usually by a hosting company. If the person who built the site has moved on, there may be no one to ask for it.

Why One Old Account Can Hurt You Now

A break-in at a forgotten site sounds harmless. Who cares about an old knitting forum? The trouble is what that forum knows about you.

• Your old password. If you used the same password there as on your email or bank, criminals will try it everywhere. They do this automatically, across thousands of sites at once.
• Your personal details. Name, email, phone number, birthday, sometimes a home address. On their own they look minor. Together they make a convincing scam.
• A believable story. A message that mentions a real site you used, and your real name, is far more likely to fool you than a random one.
  So the danger is rarely the forgotten site itself. It is the doors that site's data can open somewhere that matters.

A 20-Minute Digital Clear-Out 

You can't patch other people's websites. You can make sure that if one of them is broken into, it can't lead anywhere important.

1. Dig up your old accounts. Search your email inbox for words like "welcome", "verify your email" or "confirm your account". Old sign-up emails are a map of every site that has your details.
2. Close the ones you don't need. Look for "delete account" in the site's settings. If a site has no way to do it, change the password to a long random one so it is useless to anyone else.
3. Break the password chain. Anywhere you reused a password, especially your email, change it now. Your email is the master key, because it can reset everything else.
4. Let a password manager remember for you. Most phones and browsers have one built in. It makes a different password for every site painless.
5. Turn on two-step login for email, banking and shopping. Even if a password leaks, a code on your phone stops most break-ins.
6. Treat "security alert" messages with suspicion for the next few weeks. Big news stories bring a wave of scams. Go to the site yourself instead of clicking a link.

A word on checking links: if a message sends you to a website you don't recognise, you can paste the address into a free checker such as ScamAdviser. It gives sites a trust score from 1 to 100, built from more than 40 signals such as how old the site is and whether others have reported it. Treat the result as a second opinion, not a verdict; testers have found it can still give a dodgy site a good score. It also can't tell you whether a genuine site has been quietly broken into, which is exactly the risk with a PHP flaw like this one.

Cleaning for Your Digital Footprint 

Every account you ever opened is a small copy of you, left behind on someone else's computer. Most of the time that does no harm. This cyber-security flaw is a reminder that the internet's quietest corners are also its least defended, and that the simplest protection is to leave fewer copies of yourself lying around.

The experts will spend the coming weeks patching servers. Your job is smaller: close the doors you no longer use, and make sure none of them opens onto the ones you do.

Adam Collins is a cybersecurity researcher at ScamAdviser who operates under a pseudonym for privacy and security. With over four years on the digital frontlines, he specialises in translating complex threats into actionable advice. His mission: exposing red flags so you can navigate the web with confidence.

See Full Bio