Oakshield
Patch Verification & Compromise Review: Evidence Report
1 Executive summary Sample
Overall: action needed on 1 of 3 PHP runtimes. No evidence of compromise found in the checks listed.
Do this week
- Within 48 hours: Remove internet access to legacy.example.com/reports/ (IP allowlist/VPN or offline); ask vendor for a fixed runtime or retire the tool.
- Within 7 days: Rotate the secrets listed in the Secrets exposure section (§6).
- Until a PHP release fixes CVE-2026-115560: Keep the interim setting; update and re-assess when fixed.
Next step: an EOL Readiness Report for www.example.com and shop.example.com, credited in full toward a Runtime Switch or Upgrade Sprint within 60 days.
2 Scope and authorization Sample
- Authorization
- A1-lite, signed 2026-10-23 15:52 UTC by the customer’s Operations Director (role; name withheld)
- Optional interim setting
- Yes, opted in
- Domain re-verification
- DNS TXT at
_oakshield.example.com: pass (2026-10-23 15:55 UTC) - Server
web-01.example.test(192.0.2.10; Ubuntu 22.04 LTS; VPS, self-managed)- Hostnames
www.example.com,shop.example.com,legacy.example.com- Excluded
- exploit or penetration testing; changes other than C-01; database forensics; endpoints, email, DNS-provider and hosting-panel accounts; third-party SaaS
3 Results by CVE Sample
Status as of 2026-10-24 10:25 UTC. Evidence levels are defined in the appendix.
| CVE | R-A fpm-fcgi | R-B cli | R-C cgi |
|---|---|---|---|
CVE-2026-109618 |
Fixed by distribution backport Level 1 | Fixed by distribution backport Level 2 | Not fixed Level 2 |
CVE-2026-109619 |
Fixed by distribution backport Level 1 | Fixed by distribution backport Level 2 | Not fixed Level 2 |
CVE-2026-115560 |
Open: interim mitigation applied Level 1 | Not applicable | Open: not mitigated Level 2 |
Known open issues
- CVE-2026-115560: no fixed PHP release yet (all runtimes)
- R-C bundled PHP 7.4.33 not fixed and internet-facing
- PHP 8.1 is end-of-life upstream since 2025-12-31; fixes depend on the distribution
4 Inventory Sample
| Runtime | Path | Version string | SAPI | Source | Serves |
|---|---|---|---|---|---|
| R-A | /usr/sbin/php-fpm8.1 |
8.1.2-1ubuntu2.NN (sample placeholder) |
fpm-fcgi | Ubuntu 22.04 archive | www.example.com, shop.example.com |
| R-B | /usr/bin/php8.1 |
8.1.2-1ubuntu2.NN (sample placeholder) |
cli | Ubuntu 22.04 archive | cron, WP-CLI |
| R-C | /opt/vendor-reports/runtime/bin/php-cgi |
7.4.33 |
cgi | third-party vendor bundle (fictional 'ReportKit'), 2023 build | legacy.example.com/reports/ |
www.example.com: WordPress 7.1.2; WAF: Cloudflare (proxied)shop.example.com: WordPress 7.1.2 + WooCommerce; WAF: Cloudflare (proxied)legacy.example.com: vendor reporting tool (PHP 7.4 bundle); WAF: none (DNS-only)
5 Compromise review Sample
Window examined: 2026-10-17 00:00 UTC to 2026-10-24 08:00 UTC.
| # | Check | Data source (availability) | Result |
|---|---|---|---|
| C1 | PHP2Shell request indicators published in vendor advisories | Apache access logs, all vhosts (partial: from 2026-10-18T00:00Z (17 Oct rotated)) | Attempts observed 23 matching requests reached origin (www 19, shop 4, legacy 0) from 6 IPs (198.51.100.23, 198.51.100.77, 198.51.100.140, 203.0.113.45, 203.0.113.91, 203.0.113.200) between 2026-10-21T15:02Z and 2026-10-22T08:47Z, all before the patch; responses 200 x17, 413 x6 |
| C2 | Memory-exhaustion errors ('Allowed memory size ... Unknown on line 0') | PHP-FPM and Apache error logs (full) | Attempts observed 2 entries at 2026-10-21T15:03:12Z and 15:04:40Z, pool www, correlated with requests from 198.51.100.23; no related follow-on activity in C3-C11 |
| C3 | Worker crashes / segmentation faults | Apache and PHP-FPM logs (full) | No evidence found none |
| C4 | Processes spawned by web/PHP workers | current process tree (snapshot only (no process accounting / auditd)) | No evidence found (current snapshot only) no unexpected child processes in current snapshot |
| C5 | Core and plugin file integrity | wp core verify-checksums; wp plugin verify-checksums --all; premium plugins vs customer-supplied vendor packages (full) | No evidence found all match (www: core, 11/11 + premium; shop: core, 8/8 incl. WooCommerce + premium) |
| C6 | PHP files created/modified since 17 Oct; PHP files in upload directories | file-system metadata (web roots, uploads, /tmp, /var/tmp) (full) | No evidence found 37 modified PHP files, all from 4 plugin updates matching wordpress.org packages; 0 PHP files in uploads; 0 unexplained |
| C7 | New/changed administrator accounts | WordPress user tables via WP-CLI (full) | Explained www: user ID 57 created 2026-10-19T14:22Z, explained (customer-confirmed onboarding, ticket CUST-1182, fictional); shop: no changes |
| C8 | Scheduled tasks | system/user crontabs; WP-Cron (full) | No evidence found no new crontab entries; WP-Cron hooks only from updated plugins (expected) |
| C9 | Persistence (authorized_keys, auto_prepend/append_file, systemd units/timers) | files and configs (full) | No evidence found keys unchanged since 2026-06-02 and match customer list; prepend/append unset; no new units/timers |
| C10 | Payment-page and skimmer review (store-specific) | not included in Patch Verification; offered as Store Verification (closed until the online-store lab passes) (not included) | Not included not performed; no statement about scripts on shop cart or checkout pages |
| C11 | Outbound connections from the web user | current socket snapshot (snapshot only (no historical network data)) | No evidence found (current snapshot only) local database, payment API, update services only |
| C12 | Off-host binary verification (guards against a compromised host lying about itself) | SHA-256 of php-fpm8.1, php8.1 and loaded modules vs the same package versions downloaded from the official Ubuntu archive on an isolated scanner (full) | No evidence found R-A, R-B match; R-C cannot verify (vendor bundle, no official reference) |
| C13 | Offline snapshot scan | provider snapshot of web-01 (card AC-0001) mounted read-only on an isolated scanner; YARA-X, ClamAV, Linux Malware Detect (report-only), file integrity (full (disk only)) | No evidence found no indicators; reviewed by the Escalation Engineer |
Conclusion of the compromise review
No evidence of compromise found in the checks listed.
Confidence: moderate. Hosts exposed and unpatched during 17-21 Oct default to low confidence; raised to moderate because off-host verification (C12) and the offline snapshot scan (C13) were completed and reviewed by the Escalation Engineer.
Exploitation attempts reached the server before patching (C1, C2). This conclusion is subject to the limitations listed and does not prove the absence of compromise.
6 Secrets exposure Sample
The main runtime ran a vulnerable build until 2026-10-22 09:14 UTC. Rotate within 7 days:
| Secret | Where | Status |
|---|---|---|
| database passwords (both WordPress installs) | wp-config.php |
Not rotated in this engagement |
| WordPress authentication keys and salts (both installs) | wp-config.php |
Not rotated in this engagement. rotation logs out all users |
| payment-gateway API keys | WooCommerce payment plugin settings |
Not rotated in this engagement |
| SMTP credentials | mail plugin settings |
Not rotated in this engagement |
| other API keys in configuration | wp-config.php, plugin settings |
Not rotated in this engagement |
7 Change and approval log Sample
All times UTC. “Auto” is our delivery system, read-only or pre-approved. “Approve” is a written approval on a one-screen card before execution, by the Approver of Record or, for expert-required steps such as commerce changes, also by the Escalation Engineer. Hashes are truncated sample values.
About this sample: it shows every section a report can have. The change log and second approvals appear only when an engagement includes changes to a server. Fictional; every name is withheld.
| Time | Mode | Event |
|---|---|---|
| 2026-10-23 15:40 UTC | — | Order placed: Patch Verification, 1 server + 2 extra sites |
| 2026-10-23 15:52 UTC | — | A1-lite signed (Operations Director); interim-setting opt-in: yes |
| 2026-10-23 15:55 UTC | Auto | DNS re-verification of example.com: pass |
| 2026-10-23 16:30 UTC | Auto | Access check pv-0001: works, no sudo, read-only (A2) |
| 2026-10-23 16:41 UTC | Auto | Collector run #1 |
| 2026-10-23 17:00 UTC | Auto | Approval card AC-0001 prepared: provider snapshot of web-01 mounted read-only on an isolated scanner for C13 (customer opted in; DPA); deleted after scan |
| 2026-10-23 17:05 UTC | Auto | Compromise review C1-C13 started (C10 not in scope) (completed 2026-10-24T07:58Z) |
| 2026-10-23 17:08 UTC | Approve (Approver of Record) | Approver of Record approves card AC-0001 |
| 2026-10-24 07:50 UTC | Approve (Escalation Engineer) | Escalation Engineer approves: Reviews C1-C13 incl. C2 memory errors and C13 scan: no evidence of compromise found in the checks listed; confidence moderate |
| 2026-10-24 08:10 UTC | Escalate | R-C vendor PHP 7.4 bundle: no scripted fix path, outside change scope; customer notified 08:16 |
| 2026-10-24 08:40 UTC | Auto | Approval card AC-0002 prepared: php_admin_value[session.upload_progress.enabled]=0 in pools www and shop + graceful reload |
| 2026-10-24 09:05 UTC | — | Customer approver (IT Manager) consents to window 10:00-10:30 (A3) |
| 2026-10-24 09:12 UTC | Approve (Approver of Record) | Approver of Record approves card AC-0002 |
| 2026-10-24 09:18 UTC | Approve (Escalation Engineer) | Escalation Engineer approves card AC-0002: EXPERT-REQUIRED: pool shop serves a Commerce site |
| 2026-10-24 09:30 UTC | — | Customer grants sudo rule limited to the C-01 change script |
| 2026-10-24 10:02 UTC | Auto | Executed by change pipeline: php-fpm8.1 -t passed; graceful reload |
| 2026-10-24 10:04 UTC | Auto | Post-change checks (G7): live value 0 in both pools; 24/24 smoke URLs; sandbox checkout passed; no new PHP errors in 30 min |
| 2026-10-24 10:25 UTC | Auto | Collector run #2 (post-change); status-as-of time |
| 2026-10-24 11:20 UTC | Auto | Report drafted from structured findings |
| 2026-10-24 11:40 UTC | Approve (Escalation Engineer) | Escalation Engineer approves: Full report review (first-10) and co-sign of the compromise section |
| 2026-10-24 11:48 UTC | Approve (Approver of Record) | Approver of Record approves card AC-0003: Report v1.0 reviewed and signed |
| 2026-10-24 11:55 UTC | Auto | Report delivered |
| 2026-10-24 12:00 UTC | Auto | Snapshot copy deleted from the isolated scanner |
| 2026-10-24 12:30 UTC | — | Close-out (A5): sudo rule and pv-0001 removed by customer; confirmed in writing |
Changes made: 1 (C-01). Changes rolled back: 0. No exploit traffic was sent at any time.
8 Limitations Sample
- Access logs before 2026-10-18T00:00Z were rotated; C1 does not cover 17 Oct.
- No historical process accounting, audit or network-flow data; C4 and C11 are snapshot-only.
- Memory-only implants that left no trace in the sources examined cannot be ruled out; the offline snapshot scan (C13) examines disk contents only.
- Database content not forensically reviewed (administrators and scheduled actions via WordPress tooling only).
- Coverage limited to web-01.example.test and the three hostnames; not endpoints, email, DNS provider, hosting-panel accounts, third-party SaaS.
- Premium plugins compared with customer-supplied vendor packages, not an independent source.
- Evidence levels describe evidence held as of the stated time; new advisories can change status.
- No exploit or penetration testing performed (policy).
9 Recommendations Sample
| # | Priority | Recommendation | Owner | We can help with |
|---|---|---|---|---|
| R1 | urgent, within 48 hours | Remove internet access to legacy.example.com/reports/ (IP allowlist/VPN or offline); ask vendor for a fixed runtime or retire the tool | customer + vendor | Emergency Patch & Shield (WAF/access restriction) |
| R2 | high, within 7 days | Rotate the secrets listed in the Secrets exposure section (§6) | customer | Emergency Patch & Shield (scripted rotation) |
| R3 | keep, until a PHP release fixes CVE-2026-115560 | Keep the interim setting; update and re-assess when fixed | customer | Shield (notification) |
| R4 | medium, within 14 days | Lock www/shop origins to WAF IP ranges; put legacy behind the WAF | customer | Emergency Patch & Shield |
| R5 | medium, within 14 days | Retain access logs >=90 days; enable process accounting or auditd | customer | Shield |
| R6 | plan, before 2026-12-31 | Plan move from PHP 8.1 (upstream EOL 2025-12-31) to PHP 8.4 | customer | EOL Readiness Report |
A Evidence levels Sample
- Level 1
- Runtime-verified
- Level 2
- Package-verified
- Level 3
- Host-attested
- Level 4
- External indicator only
Data handling
Copied to our environment: collector output; log excerpts matching C1-C2 indicators (~2 MB). Database copies: none. Deletion scheduled 2026-11-23.
Sources and advisories referenced
- php.net informational advisory: session upload progress (CVE-2026-115560) (2026-10-23)
- php.net supported versions / EOL (accessed 2026-10-23)
- Datadog Security Labs: PHP2Shell (2026-10-21 to 2026-10-23)
- Palo Alto Networks Unit 42 threat brief (updated through 2026-10-23)
- Beazley Security advisory BSL-A1233 (updated 2026-10-23)