- Engineer — Plan: WordPress is pervasive in enterprise estates and this multi-vector persistence (filesystem + database + shared memory segments) means standard file-only cleanup leaves the site re-infected; audit WordPress deployments for SC_ markers in files and the database, and inspect PHP shared memory usage via shmop-based process inspection.
- SOC/IR — Plan: The shared-memory component creates a blind spot for file-integrity and AV-based scans; build or tune detections for PHP processes writing to shared memory segments (shmop_open/write syscalls) and add a correlation rule requiring simultaneous sweep of filesystem, database content, and memory when a WordPress compromise is suspected.
- Leader — Skip