GhostPaw: detection, prevention, resolution and proof

OFFICIAL GUIDANCE / INDEPENDENT TRAINING IMPLEMENTATION / NOT A LIVE AFTER-STATE

GhostPaw's route is discover → detect → prevent → patch → verify. No exploit, shell, sensitive-data access or automatic response is introduced.

1. Discover and detect: start with the actual evidence

The recorded GhostPaw run 92ad189c-9a88-4403-b773-52453963e4b8 at 2026-10-24 16:33 UTC returned five HTTP200s and five ingested synthetic app records. The actual WAF marker was Block/Detection, not enforced blocking. The scoped provider-alert query succeeded with no matching alerts. Four Healthy assessments are not CVE patch evidence.

The separate 18:35 UTC hunting capture queried three scenarios, recorded 18 unavailable and six not applicable. Missing sources are not a clean bill of health. All observed AppServices, CloudPosture and Containers plans were Standard; there was no Defender-disabled control experiment.

2. Apply the official response, not just a story-state switch

Microsoft's response and request-rule guidance, updated 2026-10-22, were reviewed 2026-10-24. The PHP fixed-version baselines are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP's security release confirms the 8.4 update. Supported later patches on those branches meet the version threshold; unknown branches/backports require vendor evidence.

Upgrading PHP is the complete vulnerability remediation. WAF is temporary supplementary mitigation. Prioritize internet-facing VMs, platform runtimes, containers and base images. Rebuild and redeploy container images; patching the host does not patch PHP inside them. Migrate unsupported branches. This portal does not run package managers, arbitrary scripts, scanners or container images.

3. Prevent: three independent request-side policies

Each custom rule is independently authored and restricted to the verified public PHP hosts and this lab's PHP routes, including /. Read-only Node evidence routes are excluded. The session-upload-progress token policy and both 20-level nesting policies are staged in Log; independently review legitimate matches and application impact before a separately confirmed Block action. Twenty levels is application policy, not a CVE-defined safety boundary.

Check terminal Allow-rule precedence, request-body inspection limits, encoded/quoted parameters and upload/session dependencies. Preserve existing rules, scrubbers, associations, private origin and pricing. No new DRS, gateway or security product is installed automatically. Request-rule matches can produce WAF logs; verify actual mode/action and HTTP behavior. A synthetic marker or heuristic match is not a PHP2Shell exploit or guaranteed CVE coverage.

4. Front Door response-side mitigation has different evidence

For an already-reviewed DRS2.0/2.1/2.2, inspect the available managed-rule catalogue for group MS-ThreatIntel-Response-CVEs, rule 99006001. Microsoft says rollout is expected through 2026-10-28; presence is checked, never assumed. The rule is disabled by default. Its prescribed anomaly action is distinct from forcing an immediate request block.

This rule sanitizes potentially malicious response elements; it does not block/challenge traffic and generates no WAF log entries or hit counts. Do not invent a matching alert or use missing logs to declare it ineffective. The action script requires a pre-existing reviewed DRS with Block anomaly policy, enables only this rule's AnomalyScoring override, and leaves every other rule/exclusion unchanged. Missing catalogue access or an absent rule is explicitly unavailable, not successful.

Other platforms: Application Gateway v2 uses the official conditional Set-Cookie response-header rewrite with the October22 corrected expression; it must not strip all cookies. Associate and test the rewrite set on its actual routes. AGC currently has request rules but no regex-based response rewrite. These are referenced manual tracks, not executable against this App Service/Front Door lab.

5. Resolution: close the fixture and prove the runtime separately

resolve-fixtures changes only the owned public application's LAB_STATE to fixed, preserves other settings and original expiry, and retains Prevention. It removes five harmless training inputs. It does not install PHP or resolve either CVE. No resolution action reopens training or downgrades WAF.

App Service's PHP|8.4 setting names a branch, not a patched full version. Check the actual PHP_VERSION returned by the trusted lab health endpoint. A branch switch or app restart is not proof that 8.4.27 is deployed. If the built-in image is below the threshold, obtain the platform's patched runtime or use a separately reviewed patched deployment; this portal does not silently migrate architecture. For private container/VM estates, follow the corresponding rebuild/package-manager vendor procedure and recheck the running deployment, not just its build manifest.

6. Scripts and protected administrator controls

The download is readable Node.js source, bundled from this repository with its shared safety helpers and vendored attribution. Requires Node24, Linux/macOS or WSL2 Azure CLI, and an already authenticated authorized account. No credential is embedded. Only the configured dev group and independently discovered owned endpoints are accepted. No host, query, command, group or package override exists.

First create a new private preview file. Apply at most one selected action per preview with exact group confirmation; the preview expires after ten minutes and its .used marker forbids replay. Generate a fresh preview after every change. The portal also binds the approval to its session/credential epoch and durable job, exact config fingerprint, audit, queue, lease and immutable expiry. Writes default off and require separately approved narrow permissions. Errors after a possibly accepted write require manual reconciliation, never automatic replay or rollback to exposure.

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-plan-01.json

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-prevention.json
node php2proof-response.mjs prevention --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-prevention.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-session-log.json
node php2proof-response.mjs session-log --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-session-log.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-session-block.json
node php2proof-response.mjs session-block --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-session-block.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-form-log.json
node php2proof-response.mjs form-log --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-form-log.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-form-block.json
node php2proof-response.mjs form-block --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-form-block.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-multipart-log.json
node php2proof-response.mjs multipart-log --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-multipart-log.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-multipart-block.json
node php2proof-response.mjs multipart-block --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-multipart-block.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-response-rule.json
node php2proof-response.mjs response-rule --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-response-rule.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs plan --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --out response-resolve-fixtures.json
node php2proof-response.mjs resolve-fixtures --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX> --plan response-resolve-fixtures.json --confirm-group NP-PHPToProof-Dev-CentralUS --yes

node php2proof-response.mjs verify --environment dev --subscription <SUBSCRIPTION_UUID> --suffix <DOJO_SUFFIX>

Download the exact script. Review node php2proof-response.mjs plan ... before any mutation; no live post-mitigation result is claimed by this guide. The original window ended 2026-10-24 18:45:04.967 UTC. This publication grants no extension or execution authorization; obtain a current explicitly approved window.

7. Verify measurable closure, then investigate residual risk

• Trusted public homepage/health remains HTTP200; actual full PHP version meets the selected advisory baseline.
• With Prevention, the harmless marked request is HTTP403. That proves the marker control, not CVE exploit prevention.
• All five unmarked synthetic inputs return HTTP404 after fixture removal. A marked403 alone is not resolution.
• The origin returns403 with and without copied FDID; the public PHP identity still has zero grants.
• Read back each real custom-rule config and review legitimate traffic/logs independently. Rule99006001 has no WAF hits/logs by design.
• Refresh relevant vulnerability/asset assessments and applicable hunts after their actual ingestion/scan cycles. Preserve source gaps, scan time, image digest/asset identity, UTC and genuine finding IDs.
• If there is real compromise evidence, preserve forensic evidence, isolate via your approved incident process, rotate exposed credentials and rebuild from trusted artifacts. This training portal does not perform incident containment or secret rotation.

Published evidence: the historical detection/baseline recordings above are actual. No post-mitigation capture has been published here for Prevention, official-rule enforcement, fixture resolution or PHP patch verification. Expected statuses are not recorded after-state results; this static guide neither queries private runs nor asserts their current status. With or without Defender, apply patches and validate controls; paid CSPM can add supported inventory/attack-path context, workload protection can add genuine detections, and Sentinel can correlate supported sources. No product guarantees a detection or removes the need for remediation.