[Opathedane]

Summary

• Focused security detection maintenance toward v2.8.1 (unreleased), driven by October 25, 2026 PHP2Shell exploitation research (ReliaQuest, Unit 42, THN coverage).
• Adds ReliaQuest-aligned error patterns (zend_mm_heap corrupted, AH00052 Abort), same-file multi-signal correlated_error_sequence, correlation-only POST 5xx assists, and Unit 42 ==SHELLUSER== / ==PASSWD== agentic delimiters under web/PHP parents.
• Evidence-integrity review: POST 5xx ↔ error stays unconfirmed (time-only; ordinary apps emit 5xx); sequence suspected only for ≥3 research kinds or shared Apache WorkerPID on ≥2 crash/abort lines; cross-file joins refused; duplicate floods collapsed; missing PID disclosed; never same-request/process proof; credentials/tokens never retained.
• No vulnerability threshold, PHP discovery, telemetry-source, or CLI/HTML/CSV/status/fleet/exit-code contract changes. Offline/read-only preserved.

Source references (new detections)

Detection	Source
php_zend_mm_heap_corrupted, apache_child_abort, correlated_error_sequence	ReliaQuest Threat Spotlight PHP2Shell (2026-10-22; Oct 25 industry reporting)
access_post_server_error (correlation-only)	ReliaQuest POST 500 sequence guidance
agentic_section_delimiter	Palo Alto Unit 42 CVE-2026-109618 / CVE-2026-109619 analysis
Existing OOM Unknown line 0 / AH00052 segfault retained	Datadog Security Labs (2026-10-21); AWS MadPot review floor

Draft notes: docs/releases/v2.8.1.md. Pattern table: docs/COMPROMISE-INVESTIGATION.md.

Confidence / severity rationale

Finding	Confidence	Why
Lone research error pattern	suspected	Verified public pattern; alone ≠ exploitation
3-kind same-file sequence (OOM+heap+crash)	suspected	ReliaQuest multi-signal; still not same-request proof
Shared Apache WorkerPID on ≥2 crash/abort lines	suspected	Stronger than time-only; PHP OOM/heap still lack PID
2-kind time-only sequence	unconfirmed	Insufficient identity evidence
POST 5xx ↔ error (±15m)	unconfirmed	Ordinary 5xx + missing shared PID
Long POST target ↔ error	unconfirmed	Unchanged weak heuristic
Agentic delimiters (web/PHP parent)	suspected	Exact Unit 42 tokens; not confirmed compromise

Before / after (examples)

Before (v2.8.0): OOM Unknown line 0 and AH00052 segfault detected; Abort/heap/multi-signal/POST 5xx assist/agentic markers absent; correlations time-only without confidence ladder.

After (this PR):

• ReliaQuest lab-style error log (OOM + zend_mm_heap + Abort ≤2m, same file) → individual patterns + one correlated_error_sequence @ suspected
• POST /wp-login.php 500 near OOM only → correlated_attempt_signals @ unconfirmed (not standalone POST 5xx lead)
• explorer.exe → cmd with ==SHELLUSER== → no lead; php-cgi → cmd with exact markers → agentic_section_delimiter (cmdline redacted)

Test plan

• go test ./...
• go vet ./...
• go test ./internal/audit/ -race
• scripts/check-release-docs.sh (unreleased 2.8.1 draft OK)
• GitHub Actions matrix (Windows / Linux / macOS + Windows legacy) after push
• Positive: ReliaQuest 3-kind sequence; shared-PID elevation; agentic under PHP parent
• Negative: app.php OOM; POST 5xx alone; cross-file sequence refused; untimed OOM excluded; duplicate flood collapse; POST 5xx flood dedup; bare/partial/lowercase marker strings; non-web parent; incomplete logs → NOT_ASSESSED (not false clearance)

Remaining limitations

• Does not detect request-body p2s-rider / multipart upload-progress values (bodies unavailable).
• Does not inventory LDAP/AD recon tooling beyond existing web-parent download/shell heuristics.
• Cannot prove same-request identity when access logs lack worker PID.
• Never emits CONFIRMED_COMPROMISE / CLEAN.

Explicit non-goals

Do not merge, tag, or publish until approved. This PR stays draft.

Made with Cursor