PHP2Shell: which PHP versions are fixed and how to check yours
The PHP project fixed 2 critical flaws on October 21, 2026. Here is which versions contain the fix, how to see what your server reports and what to ask your host.
Datahorses
Articles
Practical notes on guarding a company from the outside: email authentication, domains, certificates, DNS and the services your company exposes to the internet. A new article every 3 days.
How to vet a cybersecurity provider before you sign
A security provider gets deep insight into your company and sometimes access to it. These are the questions and documents to check before you sign anything.
SPF, DKIM and DMARC explained for business owners
3 DNS records decide whether anyone can send email that looks like it came from your domain. Here is what each one does and how to check yours in minutes.
CEO fraud and executive impersonation: how social engineering targets payments
A message that looks like it came from your CEO asks for an urgent, confidential payment. Here is how executive impersonation works and the simple rules that defeat it.
Fake invoices sent in your company's name: how business email compromise works
A customer pays an invoice that looks like yours, to a bank account that is not. Here is how the scam is built and what makes it much harder to pull off.
NIS2 for suppliers: what your customers will start asking you
NIS2 asks EU companies to manage the security of their direct suppliers. If you are one of those suppliers, expect questionnaires, contract clauses and requests for evidence.
Fake login pages using your brand: how they appear and how to get them taken down
A copy of your login page on a lookalike domain can collect your customers' passwords. Here is how such pages appear, how to spot them early and how to get them removed.
Certificate Transparency logs: what they reveal about your domains
Every trusted TLS certificate for your domain ends up in an open log. That log is a map of your subdomains and an early warning for certificates you never requested.
Attack surface monitoring vs EDR and XDR: complement, not competitor
EDR and XDR look inward at devices, logins and processes. External attack surface monitoring looks at your company from the internet. Here is why you want both views.
Exposed database ports: MySQL, PostgreSQL, MongoDB, Redis and Elasticsearch
Databases are built to talk to your application, not to the whole internet. Here is how to find out whether yours is reachable from outside and how to close it.
Gmail and Yahoo sender requirements: what changed in 2024 and what to check
Since February 2024 Gmail and Yahoo expect authenticated, aligned mail and easy unsubscribes from bulk senders. Here is what the rules say and how to check your own domain.
HTTP security headers every business website should send
A few lines in your server response tell browsers to use HTTPS, block framing and limit scripts. Here are the headers worth sending and how to check them.
SSL/TLS certificate expiration: why it still takes websites down
An expired certificate blocks visitors with a full-page browser warning and can break APIs and mail. Lifetimes are getting shorter, so renewal has to work every time.
Forgotten staging and test servers: the part nobody watches
Staging and test servers are built to be temporary, then quietly outlive the project. Here is how to find yours and decide what to keep, protect or switch off.
Exposed .env, .git and backup files: how secrets leak from websites
A single file left in the web root can hand out database passwords and API keys. Here is how .env, .git and backup files get exposed and how to check your site.
Outlook sender requirements since May 2025 and the 550 5.7.515 rejection
If mail to hotmail.com or outlook.com bounces with 550 5.7.515, Microsoft is telling you your domain does not meet its authentication rules. Here is what they require and how to fix it.
Subdomain takeover: how a forgotten DNS record becomes someone else's website
A subdomain that still points to a deleted cloud service can be claimed by anyone who registers that service. Here is how it happens and how to check your own DNS.
Unexpected nameserver or registrar changes: early signs of domain hijacking
Whoever controls your nameservers controls where your website and email go. Here is how to notice an unexpected change early and how to lock your domain down.
What happens when your company domain expires, and how to prevent it
When a domain expires, the website and email usually stop first, and the name can later be lost for good. Here is the timeline and how to keep it from happening.
Lookalike domains and typosquatting: spotting a domain built to impersonate you
A domain one letter away from yours can receive your customers' email and host a copy of your login page. Here is how to find such domains and what to do about them.
What external attack surface monitoring is (and what it is not)
External attack surface monitoring shows your company the way an outsider sees it: every domain, server and certificate on the internet, checked daily for changes and mistakes.
How it all started
Our team came together on December 4, 2020, as an elite team of developers specializing in security at Functu. Today, Datahorses is a security company of its own.