NINJAPAW / DEFENSE DOJOPUBLIC DEMO

A CODE-TO-CLOUD DEFENSE STORY / INVESTIGATION 01

PHP to Proof.
Evidence tells the story.

A fictional attack story, not an exploit runner. Real WAF behavior; synthetic PHP signals.

Start the guided walkthrough

TRAINING STATE / SYNTHETIC SIGNALS AVAILABLE
01 / POSTURE

Discover the asset

Use Defender CSPM and Cloud Security Explorer to inspect the actual deployed resource. Findings and attack paths are not guaranteed.

OBSERVE, DO NOT ASSUME
02 / EDGE

Understand the request

A benign query marker demonstrates WAF Detection, then Prevention. Its custom rule is not evidence of CVE protection.

REAL WAF / HARMLESS INPUT
03 / CORRELATION

Separate fact from fiction

PHP errors, child-process shapes, outbound shapes, and canary reads are labelled synthetic logs. None execute the described behavior.

SYNTHETIC, NOT COMPROMISE

THE INVESTIGATOR'S NOTEBOOK

One run. Multiple pivots.

Run the guarded simulator from your operator terminal. Keep its run ID and UTC time window, then correlate WAF and application records in the lab workspace.

simulate --environment dev --suffix <your-suffix> --yes
Application
Harmless PHP training workload
Data
3 fabricated ledger records
Runtime identity
No Azure role grants required
Scenario state
training
Evidence boundary
No shell, egress, or real canary access

THE DEFENDER'S LOOP

Discover. Correlate. Reduce. Verify.

  1. Discover the asset and inspect exposure
  2. Review available assessments and attack paths
  3. Generate five bounded benign requests
  4. Correlate real WAF and synthetic app evidence
  5. Validate WAF Prevention
  6. Remove training surfaces and verify closure

CVE-2026-109618 and CVE-2026-109619 are supplied investigation search terms, not findings or claims about this PHP runtime. No assessment, runtime alert, or attack path is fabricated.