Hacked Yet?byFlowtivityFree check

Hacked Yet? · Neighbourhood watch for the stuff your business runs on

Am I affected?

Dozens of security holes are confirmed under attack every month. Most businesses never hear about the ones in their own gear. Hacked Yet? reads the lists so you don't, then tells you in plain English what to fix and by when.

Free · Nothing scanned or installed · Report within a business day

8

Confirmed under attack in the last 7 days

35

In the last 30 days

0

Used in ransomware attacks in the last 30 days

On this week's list: Arista VeloCloud Orchestrator, Collabora Online – Built-in CODE Server, EG Secure Solutions SiteGuard Server Edition, Plex Media Server, Siemens Software Center.

Source: CISA Known Exploited Vulnerabilities catalogue, to 23 October 2026.

Recognise any of these? Most people can't say. The free check tells you. Run my free check

A sample heads up

One email. What to fix, and by when.

No jargon and no 40-page report. One thing that matters, what it means for you, what to do, and who to forward it to.

Heads upSampleWed 22 Oct · 7:42amFix today

Your website needs an emergency PHP update.

PHP, the language behind your website and most of the web, shipped emergency fixes this week for two critical flaws (CVE-2026-109618 and CVE-2026-109619). Attackers were using them before the fix came out, and exploitation is now widespread.

What it means for you

A site that hasn't been updated can be taken over: defaced, used to steal customer details, or used as a quiet way into your email.

What to do · about 15 minutes

  1. Forward this to your web host or developer.
  2. Ask them to update PHP to this week's patched release.
  3. Reply "done" and we'll re-check within the hour.

Neighbourhood: 11 other businesses near you run a PHP site. All of them got this heads up at 7:42am. 3 have already fixed it.

In a real heads up, these buttons forward it to your web host and close it once it's fixed.

Checked yourbusiness.com.au at 7:40am: still on an unpatched PHP version. Next check 5:00pm.

Today, the free check gets you a one-page report written by a person at Flowtivity. Heads ups like this one are next.

Run my free check

How it works

Three steps. No security homework.

01

Tell us what you run.

Your website, firewall, email, file server and accounting software. It takes about four minutes. Not sure what something is? We'll help you work it out.

02

We watch the lists you'll never read.

We start with CISA's list of flaws attackers are confirmed to be using. CISA is the US government's cyber security agency. Vendor advisories come next. Only confirmed attacks make the cut, so you hear about what matters and nothing else.

03

You get a verdict, in plain English.

Every heads up opens with Fix today, Fix this week or All clear. Then what it is, what it means for you, what to do, and who to forward it to.

The neighbourhood

Watching together beats watching alone.

Each business shares one thing: an anonymised list of what it runs. No names, no domains, no contacts. In return, once enough neighbours join, each heads up shows how many businesses nearby run the same gear, and how many have already fixed it.

Same gear, same heads up

When a flaw turns up in something you run, everyone nearby who runs it hears at the same time. Nobody finds out last.

Local by default

Counts are grouped by area, like the Tweed or the Gold Coast. If an area is too small, it rolls up into a bigger one, so no business can be picked out.

Bring your street

Invite your accountant, your web host, your suppliers. Every business that joins makes the local picture clearer for everyone.

YouRun the same firewallWatching

Example: six neighbours run your firewall. Four have already fixed it.

Who it's for

Built for businesses with no security team.

Enterprise security tools are priced and built for security teams. If you're 20 to 200 people with an office manager, a web host and an IT person you call when the printer breaks, this is for you.

Builders and trades

The site-office firewall, job management software, Xero and a WordPress site.

Clinics and allied health

Practice management software, a patient portal and a file server full of patient records.

Law and property firms

Document management, trust accounting and inboxes full of client matters.

Manufacturers and wholesalers

The ordering system nobody has updated since 2019, a network drive (NAS) and the VPN box on the wall.

Open source

Open code. Private data. We host it, or you can.

MIT licence, public code

Read it, run it, fix it, fork it. Use Claude or another AI assistant? Connect it to hackedyet.com/mcp, our free, read-only link for AI assistants (an MCP server), and ask "am I affected?" yourself. The code goes public on GitHub soon.

Runs where you want

Let Flowtivity host it, with your data kept in Cloudflare's Oceania region, or run it yourself from the public code. A ready-to-run self-host package is on the way.

Nothing installed, nothing scanned

No software on your machines and no probing of your network. It matches the exploited list against what you tell us you run. The only outside look is at your public website, the same view any visitor gets.

Free exposure check

Find out what needs fixing, and what can wait.

Four questions. Within a business day, a person at Flowtivity writes you a one-page report: anything in your gear that's under attack, and what to do first. All clear? It ends with two words: Not today.

We'll look at your homepage once, the way any visitor's browser does. Nothing is scanned.

Where your report goes. The one you check most.

What do you run? Tick what you know

We'll email you about this check. Nothing else unless you tick the box above. No sales call unless you ask for one. How we handle your details.

Questions people ask

The short answers.

Is it safe to tell you what we run?

Yes. We only need the names of the products you use. Never passwords, never access to your systems. If we host it, your list sits in a private database in Cloudflare's Oceania region. If you run it yourself, it never leaves your own setup.

Does it scan or probe our network?

No. It reads public lists of exploited flaws and matches them against the gear you tell us about. Nothing is installed and nothing is scanned. The only outside look is at your public website, the same view any visitor's browser gets.

What does it cost?

The free check and the open-source tool cost nothing, forever. The managed service, where we do the watching and chasing for you, is one fixed monthly fee in AUD, quoted up front.

Will it fix things for us?

It tells you what to fix, by when, and who to ask. The managed service goes further: we chase your web host or IT person and confirm the fix, and a person signs off on anything that touches your systems.

What does the neighbourhood actually share?

Only an anonymised list of what each business runs, so a heads up can say how many neighbours are affected and how many have fixed it. Never names, domains or contact details. Counts only appear once enough businesses in an area take part, and you can switch sharing off.

How is this different from antivirus?

Antivirus watches your laptops. This watches what antivirus never sees: your firewall, your website, your file server and the software your business runs on.