PHP2Shell: Governments Unplugged Their Own Websites. Here's What Scared Them

What would make a government switch off its own websites on purpose? And how does a flaw in the software behind most of the web stay hidden for 14 years? In this solo episode, Ron opens the case file on Black October, the month PHP2Shell pushed governments, hospitals, and banks offline around the world.

Ron starts with a rewind to Heartbleed in 2014 and the “change your password” scramble that followed. Then he explains what PHP2Shell is, why AI was the key to finding it, and how three separate teams found the same secret within seven weeks. He also walks through the timeline that doesn’t add up, including someone exploiting the flaw four days before anyone was warned.

Then he zooms out to the rest of the month, from supermarket freezers in France turning into ovens to a $6 billion crypto heist that may have started with one engineer’s laptop. Ron closes with three habits that protect you even if you’ve never written a line of code: one password per site, multi-factor authentication, and keeping your devices updated.

Impactful Moments

00:00 - Introduction 01:23 - Rewinding to Heartbleed in 2014 04:11 - Chapter 1: The Day The Lights Went Out 05:43 - Why going dark was the smart move 06:44 - Chapter 2: What Scared Them 07:55 - How AI chained the exploit together 08:24 - A 14-year-old door hiding in plain sight 08:36 - Chapter 3: The Four-Day Mystery 09:59 - Three teams, one secret, seven weeks 12:02 - Ron’s hot take on who knocked first 13:59 - Chapter 4: Black October 14:25 - Freezers turned ovens and a $6B heist 17:44 - Chapter 5: What This Means For You 19:25 - Three habits that actually protect you 22:24 - From years to weeks to days

Links

Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/