We pulled the plug to protect you, then rebuilt in a day

On October 20, the internet learned about “php2shell.” It's a pair of critical flaws in PHP, the software behind a huge share of the world's websites, ours included. The flaws let an attacker take over a web server without needing any password. Within hours, attack tools were scanning the web for vulnerable sites.

We didn't wait to find out whether we'd be next.

We went dark first. On the morning of October 21 we took tboltusa.com and every site we host offline and put up a maintenance page. Customers could still text us to place orders while we worked. Losing a morning of sales hurts a small shop. Putting our customers' information at risk would hurt a lot more.

Then we checked. Before turning anything back on, we went through our servers carefully: files, accounts, scheduled jobs and access logs, looking for any sign that someone had gotten in. We found none.

Then we upgraded, and we went all the way. The fixed versions of PHP came out that same morning. They don't cover older versions, including the one our store had run reliably for years. Patching around the problem wasn't an option, so we moved the store to the newest PHP, version 8.5, the same day. That's more than a decade of upgrades in one go. tboltusa.com was back online by early afternoon, after about three and a half hours offline.

Then we kept going. Over the rest of the day we:

• brought back every website we host, most important first, each on the patched software
• restored secure (https) connections, now set to renew automatically
• retired old sites and moved years of unused code off the public web, so there's less for attackers to aim at
• added monitoring that alerts us to site errors and expiring security certificates before they become problems
• fixed the few small glitches the big upgrade turned up, including discount codes at checkout, all the same evening

What it means for you: shopping at tboltusa.com works as it always has, on a much more modern and secure foundation. As an extra precaution we're also replacing the passwords and keys our systems use behind the scenes.

Thank you for your patience while we were down. We'd make the same call again.

— Vince Jr. & the TBolt USA team