DEV Community: The Prospect Signal Team

PHP2Shell is patched. Here's the 30-minute client check freelance web designers should run today

The Prospect Signal Team — Wed, 21 Oct 2026 18:02:58 +0000

The PHP project shipped emergency fixes this morning (Oct 21, 2026, about 9:35 AM ET) for two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, now being called PHP2Shell. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

If you build or look after WordPress, Joomla or Drupal sites for small businesses, this one lands on your desk whether you sell maintenance or not. Most of those owners have never heard of PHP, and they will call the person who built the site.

Here's a short, practical routine to get through the day without panic.

1. What actually changed (from the official advisory)

The PHP team says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. They rate mod_php highest, with a demonstrated exploit that fires before any application code runs.
They say there are no complete mitigations. Updating is the fix.
PHP 8.1 and older get no official release. The security team published minimal source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors ship their own backports.
Cloudflare said it was already seeing early attack attempts before the release (reported by BleepingComputer).

Sources: the php.net advisory and BleepingComputer's write-up.

2. Make a list of every site you touch (10 minutes)

Open a spreadsheet with one row per client site and these columns:

Site	Host type	PHP version	Who controls updates	Status

"Host type" is the column that decides your day:

Managed WordPress hosts usually patch PHP for the customer. Your job is to confirm, not to patch.
Shared hosting with a PHP version picker (cPanel "MultiPHP", Plesk and similar) usually means the host updates the minor version, but the site stays on whatever branch was picked. A site pinned to 7.4 or 8.0 is the one to worry about.
A VPS you set up is yours to patch, today.

3. Find the PHP version for each site (10 minutes)

For sites you manage, use access you already have:

WordPress: Tools → Site Health → Info → Server shows the PHP version.
cPanel: MultiPHP Manager shows the branch per domain.
A server you run: php -v, plus the version your web server actually loads (FPM can differ from the CLI).

Only check sites you look after or have permission to test. This is a client service, not a reason to poke at strangers' servers.

4. Sort and act (10 minutes)

8.2 to 8.5 on a host that patches: ask the host to confirm the fixed build, note the date, done.
8.2 to 8.5 on your own server: update packages now and restart PHP-FPM or Apache.
8.1 or older: this is the real conversation. Either the host has a backport, or the site needs a version upgrade, which means testing plugins and themes. Quote it as a small project.
You can't tell who controls it: that's the row to call the client about first.

5. The note to send clients (copy and edit)

Hi [name], a serious security issue in PHP, the software your website runs on, was fixed this morning. I've checked your site: it's on [version] with [host]. [It's already patched / I've applied the update / It needs an upgrade, which I can do this week for (price)]. No action is needed from you unless I say otherwise. I'll confirm when it's done.

Short, specific, no scare words. Owners remember who told them first and calmly.

6. What this week means for your pipeline

Every small business with an old PHP site has the same problem this week, and many have no one to call. If you sell care plans, a clear "here's what we check every month" page plus this kind of note is about as good a reason to talk as you'll get all year.

The hard part is the list of businesses to talk to. You can build it by hand: pick one city and one trade, search Google Maps, open each listing's site, and note which ones look abandoned (old copyright year, no HTTPS, broken mobile layout). Plan on about an hour per 25 businesses if you do it carefully.

Disclosure: we're The Prospect Signal Team. We sell researched lists of local businesses for web designers and agencies, starting at 250 researched prospects for $59 (500 for $99, 1,000 for $179). Everything above works without us.

How to Spot Local Businesses With Broken Websites (a 2-Minute Check Per Site)

The Prospect Signal Team — Wed, 21 Oct 2026 15:26:41 +0000

A local business that already has a website, but a broken one, can be an easier first client than a business with no site at all. The owner already believes a website matters. What they're missing is someone who noticed the problem and explained it plainly.

The catch is that "this site looks dated" isn't a reason anyone hires you. You need problems the owner can check for themselves in a few seconds. Here's the routine I'd use to find them, one site at a time.

Start with evidence, not taste

Before you open a single site, decide which problems count. Good ones are concrete and easy to verify:

The mobile layout is broken. Tiny text, overlapping buttons, sideways scrolling, or a desktop page squeezed onto a phone screen.
The browser says "Not secure". No HTTPS, or a certificate that has expired.
It's visibly stale. A footer copyright from years ago, old holiday hours, or a "new this year" banner from 2019.
The basics don't match. A phone number, address or hours that differ from the business's Google listing.
Something is dead. A booking widget that won't load, a contact form that errors, broken images, or menu links that 404.
It's painfully slow on a normal connection.

Keep only the two or three signals that match what you sell. If you build mobile-first sites with booking forms, the phone test and a missing booking path are the ones that matter. If you do maintenance retainers, the expired certificate and dead links are your opener.

Build a candidate list with one niche and one area

"Bad websites near me" is too vague to work through. Pick one niche where customers look the business up before they call (dentists, plumbers, roofers, salons, landscapers, law offices) and one city or a few neighborhoods.

Search <niche> <city> on Google Maps and open every listing that has a Website button. Pay extra attention to businesses with lots of recent reviews: people are clearly searching for them, and the site is often the first thing those people see.

The 2-minute check

For each site:

Open it on your phone (or your browser's device toolbar). Try to find the phone number and the booking or quote button using one thumb.
Look at the address bar for a "Not secure" label.
Scroll to the footer. Check the copyright year and any hours or seasonal notices.
Compare the phone number, address and hours against the Google listing you came from.
Click the main buttons (Book, Contact, Get a Quote) without submitting anything. Do they go somewhere real?
Optional: run the URL through Google PageSpeed Insights if speed is part of your offer.

Then write one sentence of evidence, for example:

Site shows "Not secure", footer says 2017, and the Book Now button opens a page that no longer exists.

If you can't write that sentence, skip the business. A site you just don't like isn't a lead.

Turn the evidence into a short opener

Lead with one or two of the problems you found, keep it friendly, and offer something small. Here's an example for a made-up dental office:

I was looking at dentists in Bayside and noticed your site shows a "Not secure" warning in Chrome, and the Book Online button goes to a page that doesn't load. Your reviews are great, so I figured you'd want to know. I fix this kind of thing for local practices. Want me to send over a short list of what I saw?

A few rules that keep replies friendly:

Don't insult the current site or whoever built it.
Don't promise more patients, calls or rankings.
Recheck the site right before you send. Owners do fix things, and pitching a problem that's already gone ends the conversation.

Who to target first

Small, owner-run businesses are the best fit. The site was often built years ago by a relative or a long-gone freelancer, nobody maintains it, and the person who reads your message is the person who decides.

Larger companies with dated sites usually already have an agency or a marketing person, so the same message lands in a queue. If you go after them anyway, find the marketing contact and point to one specific page, not the whole site.

Keep a simple tracking sheet

One row per business is enough:

Column	Example
Business name	(as listed on Maps)
City	Bayside
Website	the URL you checked
Phone	from the listing
Maps listing URL	so you can recheck later
Signals found	not secure, old footer, dead booking link
Evidence note	your one sentence
Status	contacted / replied / not now

Send a small batch, note who replied, then move to the next neighborhood or niche. If a business turns out to have no working site at all, move it to a separate list, because that pitch is different.

Wrapping up

The whole method is: pick a niche and an area, check each site for problems the owner can verify, write one sentence of evidence, and open with that. It takes a few minutes per business, and it beats sending "I can redesign your website" to everyone on the map.

Disclosure: we're The Prospect Signal Team. If you'd rather skip the manual checks, we research local businesses with outdated or broken websites for you, with the evidence note on every row: 250 researched prospects for $59, or 500 for $99 and 1,000 for $179.

How to Find Local Businesses With No Website (and Turn Them Into Web Design Clients)

The Prospect Signal Team — Tue, 20 Oct 2026 16:05:13 +0000

If you build websites for small businesses, the most natural first conversation is with a business that has no website at all. There is no "your current site is slow" debate and no agency to replace. There is just a visible gap and a simple question: would a site help?

The hard part is finding those businesses, confirming the gap, and reaching a busy owner. Here is the process, step by step.

1. Pick one niche and one city

"Businesses without websites near me" is too broad to act on. Pick one business type and one area, and finish that list before moving on.

Two things make a niche worth your time:

They rely on local customers who look them up. People search for a roofer, a vet or a pressure washer by name and by "near me".
One new customer is worth a lot to them. A single roof replacement, HVAC install, dental patient or regular vet client can pay for a simple website many times over. That makes your price an easy conversation.

Where to start: auto repair. We hand-checked 159 auto repair listings on Google Maps across 10 US cities, and 26 of them (16.4%, about 1 in 6) had no website of their own, compared with 4 of 319 across five other niches we checked. The share was higher further down the results (19.0% in results 21 to 28 versus 13.8% in results 1 to 8), so scroll past the top of the map. The tables, method and a CSV of every listing are in our auto repair hand count. Other niches you can try: roofers, HVAC, plumbers, general contractors, landscapers, pressure washing, cleaners, vets and dentists.

Then choose one city, or a few neighborhoods in a big metro. A tight scope makes your message more specific ("I was looking at roofers in Tulsa...") and your list easier to finish.

2. Search Google Maps with simple patterns

Almost every active local business has a Maps listing. Use plain search patterns:

roofing contractor Tulsa OK
hvac repair Spokane
pressure washing Tampa FL
veterinarian Richmond VA
emergency plumber 85032 (ZIP codes help in large cities)

Open each result and look at the action buttons. A listing with a Website button has a linked site. A listing that only shows Call, Directions and Share does not have one linked.

Zoom into different parts of the city and search again to surface smaller businesses that never show on the first screen.

Record each candidate in a spreadsheet with these columns:

Column	Example
Business name	(as listed)
Maps listing URL	link to the listing
Phone	from the listing
Review count / last review date	42 / two weeks ago
Evidence note	"No site linked; Facebook page only"
Status	not contacted / called / follow-up 1 / replied

3. Confirm the website is really missing

A missing link on Maps is a clue, not proof. Plenty of owners have a site and simply never added it to their listing. Before you count a row, spend one minute checking:

Search the exact business name plus the city in normal Google search.
Look through the listing's photos. A URL often shows up on a truck, a yard sign or a flyer.
Check Facebook, Instagram, Yelp, Nextdoor and booking platforms. Many trades run entirely from a Facebook page.

A Facebook-only business is still a strong prospect. It just changes your pitch: they already understand being found online, they just do not own a page that ranks, takes quote requests or works for people who are not on Facebook.

Write what you found in one sentence. For example: "No website linked on Maps; only a Facebook page, last post in September." That sentence is your evidence note, and it becomes the core of your first message.

4. Check that the business is active

A business with no website and no activity may be closed or winding down. Look for signs of life:

Recent reviews. Reviews from the last few months mean customers are still finding them.
Review count. A listing with dozens of reviews and no site is usually the best kind of row. They already have demand, and people already look them up.
Hours and photos. Current hours and recent owner-uploaded photos are good signs.
A working phone. If you call and it is disconnected, drop the row.

Skip listings marked "temporarily closed" or with no reviews in over a year.

5. Qualify quickly

You do not need a complex scoring system. For each row, answer three questions:

Is the website gap confirmed? (Step 3)
Is the business active? (Step 4)
Is there a working public phone number?

Three yeses means the row goes on your call list. Anything else gets dropped or parked.

6. Lead with the phone, not email

Many businesses without websites also have no public email address. The phone number on the Maps listing is the most reliable contact you will have.

Some practical tips for calling:

Call at sensible times. For trades, mid-morning or mid-afternoon on weekdays usually beats first thing in the morning, when crews are heading out.
Ask for the owner by role, not by a name you guessed: "Is this the owner? I had a quick question about your Google listing."
Keep it under a minute. Say what you saw, offer one specific thing, and ask whether you can send it.
Offer to text or email a mockup. Many owners prefer to look at something later instead of talking now.

If there is an email on the Facebook About tab or a booking page, use it as a second channel, not the first.

7. A short first message that names the gap

Whether you are calling, leaving a voicemail or sending a text or email after the call, the message should be short and based only on what you actually saw. Here is a template:

Hi, I was looking at HVAC companies in Spokane and found your Google listing. You have great reviews, but there is no website linked, so people can only call or find your Facebook page. I build simple sites for local service businesses with a quote request form and your reviews on the page. Would it be OK if I sent you a quick mockup for your business?

Why it works:

It names the specific gap you observed.
It references something positive and true (their reviews).
It offers one concrete thing (a mockup) instead of a vague "let's chat".
It makes no claims you cannot back up. Do not tell an owner they are "losing customers" or promise a number of new jobs. Let them decide whether the gap matters.

8. Follow up, but space it out

Most replies do not come from the first touch. A simple cadence that stays respectful:

Day 0: call. If no answer, leave a short voicemail and send a text or email if you have one.
Day 3 or 4: a second, shorter touch. "Following up on the website mockup for your business. Happy to send it over if useful."
Day 10 or so: one last note, then mark the row closed.

Following up the next day feels pushy to a busy owner. Three or four days apart gives them room. Log every touch in your status column so you never contact the same business twice in a week.

9. Track and repeat

Work a small batch first, maybe 20 to 30 businesses, and note who picks up and what they say. Then move to the next neighborhood or niche with the same columns. After a few rounds you will know which niches care about having a site.

If you would rather skip the research

The Maps checks above are the slow part. Full disclosure: we run Prospect Signal, which sells researched lists of local businesses without websites by niche and city, 250 for $59. Every prospect includes a public business phone number; email included where found. Each row also has the source link and an evidence note like the one in step 3. If that saves you time, you can see how no-website lead packs work here.

Either way, the process is the same: one niche, one city, a confirmed gap, a phone call and a message that names exactly what you saw. Good luck with your outreach.

The Prospect Signal Team