December, the end of security support for 8.1, and a host running it that nothing in the deployment inventory knew about.
how it was found: not by the inventory, which lists
four hosts and had all four on 8.4.
by a certificate scan, in October, which found a
listening service on an address nobody recognised.
a staging host from 2021
running a copy of the application at the 2021 commit
reachable from the internet
on PHP 8.1
with a database containing real customer data copied
for a debugging session in 2022
it was destroyed the same day.The end-of-life date is not the story here and the discovery is. An inventory that lists what you deployed is not an inventory of what is running, and the only thing that found this was a scan of our own address space done for an unrelated reason — which is now scheduled quarterly rather than being a thing somebody thought of once.