The Executive Cyber Defense Checkup: 5-Phase Interactive Security & Dark Web Audit for Business Owners

With the October 2026 wave of critical PHP vulnerabilities (PHP2Shell) and infostealer malware bypassing two-factor authentication, here is the complete 5-Phase Interactive Security Checkup to audit your domains, personal identity, local workstation, and cloud infrastructure.

In late October 2026, the cybersecurity landscape experienced a dual crisis: the disclosure of PHP2Shell (CVE-2026-109618 / CVE-2026-109619)—a critical 9.2 CVSS Remote Code Execution flaw affecting 70% of the web—coupled with an epidemic of infostealer malware and rogue OAuth token persistence that silently bypasses passwords and two-factor authentication.

Whether you are preparing to log into a new staging environment, managing high-traffic client assets, or protecting your brand identity, you cannot rely on assumptions. Below is the exact 5-Phase Interactive Security Checkup framework. You can use it as a personal runbook or copy the prompt directly into your preferred AI reasoning model to conduct a guided diagnostic audit.

Act as a Senior Cybersecurity & Threat Intelligence Consultant. With the recent October 2026 wave of critical web vulnerabilities (like php2shell / CVE-2026-109618 & CVE-2026-109619) and infostealer malware targeting business owners, I want to run a complete security, identity, and dark web audit on myself, my computer, and my business before I access a new staging website.

Do NOT dump a giant wall of instructions all at once. Guide me through a 5-Phase Interactive Security Checkup ONE phase at a time. Wait for my response after each phase before moving to the next.

Start by asking me three quick questions:
1. What operating system am I using right now (Mac or Windows)?
2. What is my primary business domain name (and any secondary domains we own)?
3. Do I have web search turned on in this chat so you can look up public records for my domain? (If you have web search capability, use it during Phase 1).

Once I answer, take me through these 5 phases step-by-step:

PHASE 1: Business Domain & Dark Web / Breach Exposure
- Use your web search tool (if available) to check public signals for my business domain: look for any public breach mentions, check if our SPF, DKIM, and DMARC email spoofing protections are properly configured, and check Certificate Transparency logs (via crt.sh) for any strange or forgotten subdomains.
- Direct me to run my email addresses and business domain through free, no-signup breach and stealer-log scanners right now (specifically HaveIBeenPwned.com, DeXpose.io's free domain/dark web report, and Pentester.com or Hudson Rock's free Cavalier infostealer check). 
- Tell me exactly what red flags to look for in the results (especially "stealer logs," which mean malware pulled saved passwords and cookies straight off a device) and ask me to report back what I find.

PHASE 2: Local Computer & Browser Infostealer Audit
- Based on whether I am on Mac or Windows, give me 3-4 dead-simple checks (or safe Terminal/PowerShell commands I can copy-paste and show you the output of) to verify:
  1. Unrecognized background persistence items, launch agents, or startup tasks.
  2. Sketchy or over-privileged browser extensions in Chrome/Safari/Edge.
  3. Whether my OS firewall, disk encryption (FileVault/BitLocker), and latest October 2026 OS security patches are active.
  4. Why saving passwords inside my web browser is dangerous against modern session-stealers, and how to clear active session risk.

PHASE 3: Email & Identity Hardening (The "Keys to the Kingdom")
- Walk me through a 2-minute audit of my primary Google Workspace or Microsoft 365 account:
  1. Checking for unauthorized inbox forwarding rules or hidden filters (a classic sign an attacker is silently watching my email).
  2. Reviewing connected third-party OAuth apps and revoking old ones.
  3. Checking currently logged-in devices and killing unrecognized sessions.
  4. Ensuring my MFA isn't vulnerable to simple SMS interception.

PHASE 4: Existing Business Web Properties & Vendor Check
- Since CVE-2026-109618 and CVE-2026-109619 affect all PHP web servers globally right now, help me identify if any of my CURRENT live websites, landing pages, or client portals run on WordPress or PHP, and give me a 2-sentence script I can send my current web host to verify they applied the October 21, 2026 PHP runtime patches (8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+).

PHASE 5: Safe Staging Review Protocol & Credit/Identity Lock
- Give me a quick checklist for safely accessing the new staging site (using a dedicated password manager entry, never reusing passwords, and keeping staging URLs out of public AI tools or unsecured channels).
- Give me the quickest way to verify my personal identity/SSN isn't being used (checking active credit freezes at Equifax, Experian, and TransUnion).

Keep your tone practical, reassuring, and jargon-free. Let's begin with your initial 3 questions.

The 5-Phase Methodology Explained

Phase 1: Business Domain & Dark Web Reconnaissance

Modern attacks rarely begin with a brute-force assault on your front door. Instead, adversaries query Certificate Transparency logs and dark-web repositories to find neglected subdomains (like staging.old.company.com) or compromised credentials.

• Certificate Transparency Audit: Query crt.sh with your domain to inspect all issued SSL certificates. Look for staging servers, dev portals, or legacy endpoints that were forgotten but remain live.
• Email Spoofing Protection (SPF/DKIM/DMARC): Verify your DNS TXT records. Without an active DMARC policy (p=reject or p=quarantine), attackers can forge emails appearing to come directly from your executive team.
• Hudson Rock Cavalier Check: Search Hudson Rock's Cybercrime Tools. Over 36 million physical computers infected with infostealers have been indexed. A hit indicates that malware on an employee or contractor device dumped browser session cookies and passwords.
• Have I Been Pwned & DeXpose: Query HIBP and DeXpose for commercial database dumps and dark-web credential lists.

Phase 2: Local Workstation & Browser Infostealer Audit

Infostealers (like RedLine, Lumma, and AMOS for macOS) do not log keystrokes—they copy the unencrypted SQLite database holding your browser's active session cookies (Cookies file). Once copied, attackers inject the cookie into an anti-detect browser and log into your accounts without needing a password or 2FA prompt.

• Audit Launch Persistence (macOS): Inspect ~/Library/LaunchAgents/ and /Library/LaunchDaemons/ for unsigned background binaries.
• Audit Startup Items (Windows): Inspect Get-CimInstance Win32_StartupCommand in PowerShell.
• Extension Pruning: Review chrome://extensions/. Any extension with permission to "read and change data on all websites" is an attack vector if sold or compromised.
• Never Save Passwords in Browsers: Always use an external, zero-knowledge password manager (like 1Password, Bitwarden, or KeePassXC) rather than the native browser vault.

Phase 3: Email & Cloud Identity Hardening

Your primary email (Google Workspace or Microsoft 365) is the master key to your digital existence. Compromised email accounts allow attackers to trigger password resets across all your banks, registrars, and cloud providers.

• Hidden Forwarding Rules: Attackers often configure silent forwarding rules (e.g., forward any email containing "invoice" or "reset" to an external address, then archive it). In Gmail, check Settings → Forwarding and POP/IMAP and Filters and Blocked Addresses.
• Audit Third-Party OAuth Apps: Visit myaccount.google.com/connections. Filter by "Access to your Google Account". Delete old tools, extensions, and integrations. Remember: changing your password does not revoke OAuth tokens.
• Terminate Ghost Sessions: Visit myaccount.google.com/device-activity and remotely sign out of any device you don't recognize.
• Video Walkthrough: Watch How To Review Apps or Website Connected To Your Google Account for visual confirmation.

Phase 4: Web Properties & The PHP2Shell Emergency

The NSA, FBI, and CISA issued an emergency directive regarding PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Any unpatched server running PHP is vulnerable to unauthenticated remote code execution.

Send this verification script to your hosting provider:

"Please confirm in writing the exact micro-version of PHP actively serving HTTP traffic for my domain, and confirm that our runtime includes the October 21, 2026 emergency security patch for CVE-2026-109618 and CVE-2026-109619 (PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+). Please also confirm that expose_php is disabled on this server."

Phase 5: Safe Staging & Personal Credit Freezes

• Staging Access Rules: When accessing an unreleased website or client staging environment, generate a unique 25+ character password inside your password manager. Never reuse a password. Never paste staging URLs or credentials into public AI prompts.
• Personal Credit Freezes: Freeze your credit files at the three major bureaus (Equifax, Experian, TransUnion). A credit freeze prevents anyone from opening fraudulent accounts in your name even if your Social Security Number was leaked in a breach.

Frequently asked questions

Why doesn't 2-Factor Authentication (2FA) stop modern infostealer malware?

Infostealers don't steal passwords—they extract active SQLite browser session cookies directly off your computer's disk. When imported into an attacker's browser, the target service recognizes the session as already logged in, bypassing password prompts and 2FA completely.

Why do third-party apps still have access after I change my Google password?

When you grant an external app permission to your Google account, Google generates an OAuth refresh token. These tokens operate independently of your password and remain valid until manually revoked in myaccount.google.com/connections.

What should I do if my domain is flagged in Hudson Rock Cavalier?

A hit in Hudson Rock Cavalier means a device that authenticated into your domain or email was compromised by infostealer malware (like Lumma or RedLine). Immediately wipe or isolate the infected device, use 'Sign out of all sessions' in Google/email, and rotate all credentials stored in that browser.

How do I check if my web host patched PHP2Shell?

Ask your host in writing what exact PHP version serves your HTTP traffic. Secure releases include PHP 8.2.35+, 8.3.36+, 8.4.27+, and 8.5.12+. If your site runs PHP 8.1 or older, no official patch exists and you must upgrade immediately.