The PHP2shell vulnerability has brought up the topic of shadow IT quite a bit. That famous story of the PHP server that got buried in a remodeling of the office and is now sitting literally inside a wall somewhere, or something like that. Let me tell you a little story.

In the early 2000s, I wrote a piece of software to keep $client's menu boards at their restaurants up to date. The system that pushed it out, which was based on Micros, was not particularly reliable, so we wrote a separate service to check and make sure it worked, and if not, to trigger the upload again.

Nobody knew we had written this service. Nobody knew how the menu boards were being kept up to date. All they saw was that things were sometimes triggered twice. There were a couple of people we told, "We have a system that's doing that." That system was literally a workstation under my desk at the client, running a Windows service that I had written in C#. That was what was updating those menu boards.

I got a call two years ago from my old manager saying, "We've moved on from Micros. I wanted you to know we're finally turning this machine off." Uptime, I don't know, somewhere around 3,000 days. It was ridiculous.

Anyway, you would know the name of the client. Big companies fall to this really easily. It's definitely a thing. Look around.