Too small to be a target? Automated attacks don't check size

Do attackers really skip small companies?

There's little evidence that being small gets you skipped. Most of today's attacks come for an internet address and the gap at that address, not for a company's name.

The old-time burglar chose a house. He checked how high the wall was and whether the family looked wealthy, then waited for night. Today's attack programs are different. They're like a machine that walks down the street trying every door handle in turn. They don't read the name on the mailbox. They only check whether the door opens.

The old picture

• Attackers pick a company
• Big, rich companies come first
• We're too small to be noticed

What happens now

• Programs sweep addresses in order
• The first door that opens gets used
• Small sites with gaps are fair game

So the question changes. Not "Are we worth targeting?" but "Is our door locked?"

Gaps, not names.

Jeensuk's take"Who would target us?" has no answer. "Is our door locked?" does.

How did automated attacks actually behave this time?

From the first day PHP2Shell was public, attack programs sent the same requests to servers everywhere, without regard to who owned them. A US security firm and Cloudflare recorded it.

VulnCheck runs decoy servers, called canaries, to watch attacks. On October 21, 2026, the day PHP published the fix, it reported that one source address "connected to 188 canary hosts" and another to 26, sending file-upload requests "on hosts in several cloud regions and providers."¹

Cloudflare said "the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers."²

We expect to continue seeing widespread exploit attempts with public PoCs. — VulnCheck, Oct 21, 2026

A decoy server is an empty house with no name on it. It has no company name and no revenue. The door handles were tried anyway, which tells you the programs don't look at who lives there.

Jeensuk's takeTo an attack program, your website isn't "a small company." It's "one address." And everyone has one.

What do the numbers say, and what don't they say?

The numbers show cybercrime is large and that unpatched software is a leading way in. They don't show that small businesses are hand-picked. What they show is that there's no evidence size keeps you out.

And PHP is under a large share of the web, as of October 25, 2026. This vulnerability isn't a big-company story. It sat under the floor of a great many business websites.

Jeensuk's takeI won't inflate the numbers. But there aren't any numbers that back up "we're small, so we're fine," either.

Why does "it won't happen to us" feel so true?

People tend to believe bad things are more likely to happen to others. Psychologists call it optimism bias. It's not a failing; everyone has it.

In a 1980 study, the American psychologist Neil Weinstein showed that people expect bad events to happen to them less often than to others.⁶ It shows up in business too: in a 2025 survey of 1,000 executives at organizations with under $100 million in revenue, 64% said their organization is "too small to be an attractive target."⁷ And the hacks in the news are always famous big companies. A small company's breach doesn't make headlines, so there's no picture of it in our heads.

Jeensuk's takeThere's no need to blame yourself for thinking "not us." Just turn that thought into one quick check.

So what should you check first today?

Start by finding out whether your site is affected by this vulnerability. It takes a minute. Decisions come after.

The first step against a machine that tries every door isn't fear. It's knowing what kind of lock is on your door.

1. See if you're affected: take the one-minute check, five questions that sort you into "Not affected," "Needs checking" or "Needs action" (English edition coming soon).
2. Read your host's notice: on shared or managed hosting, many hosts applied the fix for you. Hostinger, for example, said every plan except VPS needed no action.⁸
3. Ask one question: ask your developer or whoever manages the site, "What PHP version are we on, and has the fix been applied?"
4. Look for traces: if you worry someone got in before the fix, see the web shell self-check (English edition coming soon).

If it all comes back "Not affected," that's a great result too. Peace of mind you checked for weighs more than peace of mind you guessed.

Jeensuk's takeA small company's strength is that it can check fast and decide fast. Today, it takes a minute.