Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 18, 8:49:38 PM PDT
Evidence through
Aug 18, 8:50:18 PM PDT
AI status
Complete
True positive98% confidence

The incident is a true positive for opportunistic PHP/WordPress web-shell path enumeration, not for confirmed compromise. The source traffic cluster generated a rapid series of GET probes across many PHP/WordPress-associated paths. The incident aggregate records 214 requests against 109 unique probe paths in about 40 seconds, with all 214 classified as rejected responses. Verified representative requests returned only 301 redirects or 404 responses. No process- or flow-plane event references are cited by this incident, so execution, persistence, or outbound activity cannot be adjudicated from those planes and is not claimed.

Attack stage
Reconnaissance / discovery: opportunistic enumeration of PHP and WordPress web-shell paths
Model
gpt-5.6-sol · 6 evidence calls

Observed impact

  • Confirmed hostile or unauthorized-looking enumeration traffic reached the HTTP gateway.
  • No successful exploitation or post-exploitation consequence is established; observed HTTP outcomes were redirects or rejections.

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

214 observations · 12 http

Explicit uncertainty

  • No process-plane evidence references are cited by this incident; therefore workload command execution, process creation, and persistence cannot be independently assessed.
  • No flow-plane evidence references are cited by this incident; therefore correlated outbound connectivity or destination novelty cannot be assessed.
  • HTTP status codes and rejection classification do not by themselves prove that the workload was uncompromised; the available response summaries contain no verified command-output indication.
  • The source key identifies a traffic cluster, not a guaranteed person or single agent; it may represent a proxy, NAT gateway, or multiple workers.
  • Target workload affinity is inferred from configured routing rather than an observed per-request trace edge.

Recommended actions

  1. Retain the gateway evidence and continue monitoring the source cluster and targeted path categories for recurrence or a transition to POST requests, payload-bearing requests, or non-rejected responses.
  2. Apply proportionate rate limiting or temporary blocking to the traffic cluster if policy permits, accounting for possible proxy or NAT collateral impact.
  3. Review workload and application logs around 2026-08-19 [redacted]38Z–[redacted]19Z for matching requests, authentication changes, file writes, or unexpected PHP execution.
  4. Verify that unused PHP/WordPress endpoints are disabled and that any deployed WordPress core, plugins, themes, and PHP runtime are patched.
  5. Perform a targeted integrity review of web roots and upload directories for unexpected PHP files; escalate only if independent compromise indicators are found.