I fix online storesother people built.

Roughly 15% of requests returned HTTP 500 — 825 of them in a ninety-minute sample. The daily count was doubling: 17 fatal errors on 4 August, 413 on the 18th, 915 on the 21st. The hosting company pointed at the connection limit and stopped there.

Every fatal error was the same line: the database connection inside the session handler. The host confirmed the account was hitting its cap of 30 concurrent connections.

The session table held 18 715 802 rows and 2 284 MB — 89% of the entire database. Sessions from 2023 were still in it.

Every request, including every bot, writes to that table. Against 2.3 GB each write holds its connection long enough for thirty of them to overlap. The server itself was healthy: 40 cores at 40% load, 67 GB RAM free. The neighbours were not the problem.

OpenCart 3 compares an integer against a datetime column in its session garbage collector, so the cleanup query matched nothing — not once, in three years. Sessions simply accumulated until the connection cap did the rest.

Nothing looked wrong. Visitors got the real shop. So did curl, PageSpeed, Ahrefs, the uptime monitor and every scanner the owner tried. Meanwhile the homepage was being reindexed as a Turkish gambling page, carrying a canonical tag that pointed back at the client’s own domain.

The cloak shipped a decoy list of user agents — curl, wget, python, ahrefsbot, semrushbot, lighthouse, pagespeed, gtmetrix, uptimerobot, gptbot — and switched itself off for every one of them. That is why no scan had ever found it.

index.php reported a modification time of August 2025 and a change time of 1 September 2026. The attacker had reset mtime with touch; ctime cannot be forged without root. That one mismatch is what exposed the file — searching by modification date would have missed it entirely.

Two independent footholds, not one: an injected block in index.php, and a .user.ini setting auto_prepend_file, which PHP loads before every request in the directory no matter what index.php says.

The access log named it exactly. A theme controller ran unserialize(base64_decode($_POST[…])) — PHP object injection, in a file dated 2022 that had never been patched. A scanner walked through known-vulnerable endpoints of other OpenCart themes, collected a 404 from each, hit this one, and had a web shell 24 seconds after its first request. The same line existed in five places; one of them was overridden by an OCMOD build, so patching the original file alone would have left the busiest endpoint wide open.

The account had grown to 35 GB of a 48 GB quota and was still climbing. The obvious move was to buy a bigger plan.

The product originals were not what was growing: 18 to 19 GB over four days. The thumbnail cache went from 8.8 to 16 GB in the same window.

OpenCart’s stock image library writes JPEG thumbnails at quality 90 and applies no compression to PNG at all. So the cache was not a symptom of too many products — it was the engine, producing oversized files for every new size it was asked for.

Compressing what was already there would have bought a few weeks. The engine had to stop producing it, which is a small patch to the image library plus one pass over the existing files.

The client’s words were that the live CRM was far from the prototype, on every page and every block. The expectation in the room was a rebuild.

The components were right. The stylesheet order was not: the design kit loaded before Tailwind, so preflight was resetting every heading, and a single body class was overriding the kit’s typeface. Two structural fixes put most screens back where they belonged and reduced the real gap to scope.

From there it was work, not archaeology: 21 screens, 12 report tabs, 8 finance sections. Everything the prototype had faked in browser storage moved into real tables — proposals, client credentials with encrypted secrets, a company activity log, contracts, a call journal. Plus the parts a prototype never has to answer for: a period picker that drives flows but deliberately leaves point-in-time figures alone, because “overdue invoices as of April” is not something anyone can act on today.