Reports and research
Every report here is drawn from real engagement work, sanitized so it protects clients while showing exactly how findings, evidence, remediation, and retesting are documented. No email address or account is required to read or download anything.
The reports
Incident report · September 2026
Wordfence reported 283 infected files, ImunifyAV agreed, and the database export was completely clean. The backdoor was a packed ELF binary hidden above the web root — with the detection method, the artifact properties, the file hash, and the triage checks for your own server.
Read the WHM server backdoor reportIncident report · August 2026
A coordinated infection investigated layer by layer: obfuscated PHP, database persistence, theme injection, and PHP startup directives, with IOC triage, MITRE ATT&CK mapping, and a fleet retest protocol. Includes a free PDF.
Read the full incident reportSample deliverable
A sanitized, representative audit deliverable: how findings are written, how severity and business impact are argued, what positive controls look like, and how retest status is tracked to closure.
Review the sample audit reportRelated reading