Typecho Handsome 主题加密授权验证陷入死循环，导致服务器 CPU 满载
英文摘要
A legitimate buyer of the Typecho Handsome theme discovered that its license verification logic in the encrypted CoreInterface.php file caused an infinite eval() loop. The loop pushed a 4-core CPU to 100% utilization and high load, making the site unresponsive. The issue persisted across multiple PHP versions and after confirming server connectivity, pinpointing the theme’s obfuscation method (DyEncrypt) as the culprit. The theme author was unreachable, leaving the user without a fix and forced to disable the theme to restore service. The incident highlights the risks of aggressive, heavily obfuscated licensing checks in commercial themes.
中文摘要
一位正版购买 Typecho Handsome 主题的用户发现，该主题加密文件 CoreInterface.php 中的授权验证逻辑因多层 eval() 陷入死循环。该循环导致 4 核 CPU 瞬间 100% 满载、网站无响应。用户尝试更换多个 PHP 版本并确认服务器网络连通性后问题依旧，定位为 DyEncrypt 混淆验证机制所致。主题作者长期失联，用户不得不停用主题来恢复服务。此事暴露了商业主题中过于激进的加密授权校验可能带来的严重性能风险。
关键要点
The Handsome theme’s CoreInterface.php, obfuscated with DyEncrypt, uses multiple layers of eval() for license verification, which under certain conditions enters an infinite loop.
Handsome 主题的 CoreInterface.php 经 DyEncrypt 混淆，采用多层 eval() 进行授权验证，特定条件下陷入死循环。
The loop caused immediate 100% CPU usage on a 4-core server, rendering the website inaccessible.
死循环导致 4 核服务器 CPU 瞬时满载，网站无法访问。
The user is a legitimate purchaser, tried different PHP versions, verified curl connectivity, and reinstalled files, but the problem persisted.
用户为正版购买者，尝试了多个 PHP 版本、确认 curl 连通性并重新覆盖文件，问题依旧。
The theme author was unresponsive, leaving the user with no official support or patch.
主题作者长期未回应，用户得不到官方支持或补丁。
This case demonstrates how over-engineered, encrypted license checks in commercial software can cause severe performance degradation and denial-of-service risks.
该案例表明，商业软件中过度设计的加密授权校验可能引发严重性能降级和服务不可用风险。