Ghostdrive

News · Academy · November 12, 2026

Academy: know what you expose to the internet

About 29 million PHP servers and countless admin panels face the internet. How to find your own exposed systems before an attacker does.

DRIVE 369 DAO · 2 min read

Academy, organisations, lesson 4. You cannot defend what you do not know you have. Attackers scan the whole internet every day, and what they find first is what gets attacked first.

Scale

Bitsight measured about 29.2 million PHP hosts on the internet before the PHP2Shell disclosure (Bitsight), and Censys counted 54.9 million web properties running PHP (Krebs on Security). The confirmed compromises in that campaign included about 25 Palo Alto firewall management interfaces that had been left open to the internet (Unit 42). Palo Alto says management interfaces are not exposed by default under best practice: these had been left reachable.

What to look for

  1. Management interfaces: firewalls, routers, hypervisors, database consoles, admin panels, remote desktop and SSH. These should not face the internet.
  2. Forgotten websites and subdomains: a test site from 2022, an old marketing page, a staging server.
  3. End-of-life software: Bitsight found that about 11 million exposed PHP hosts were on branches that no longer get fixes.
  4. Cloud storage and databases open to the public.
  5. Third-party systems you rely on: the vendor that holds your data is part of your attack surface.

How to see it as an attacker does

  • Search for your own domains and addresses on Censys or Shodan. Both show what a scanner sees.
  • Check your DNS for names you do not recognise.
  • Use your provider's tools. Cloudflare's Security Center maps internet-facing assets and reports findings on DNS, certificates, WAF and Access settings by severity. It points to the setting but does not fix it for you.
  • Tag what is reachable. The CISA directive BOD 26-04 asks agencies to tag each externally reachable asset with its organisation, environment, exposure and type. The same four tags work for any company.
  • Repeat monthly. Exposure changes every time someone opens a port.

Then reduce it

Close what does not need to be open. Put the rest behind a login. Cloudflare's Access product works on a deny-by-default model with explicit Allow and Block policies and can require a specific multi-factor method. Remove admin panels from public addresses and reach them through a private network or an identity-aware proxy.

How Ghostdrive approaches it

Ghostdrive's node serves its API on the local machine by default, its relays expose only the services they need, and we put decoy paths on the relay that ban scanners looking for admin panels. Exposure still has to be managed by you for your own servers, and we do not scan other people's systems.

Academy: start here · Patch triage · Cloudflare and AI for security