# FaultyPacket — Complete Technical Reference & Practitioner Playbook (`llms-full.txt`) > Canonical URL: https://faultypacket.co.uk/llms-full.txt > Summary Index: https://faultypacket.co.uk/llms.txt > Updated: 2026-10-25 > Operator: FaultyPacket (United Kingdom) — `security@faultypacket.co.uk` | X `@faultypacket` | Fiverr `fiverr.com/faultypacket` --- ## 1. Fixing Gmail `550-5.7.26` & Microsoft 365 `550 5.7.515` Email Rejections (SPF, DMARC, DKIM, MTA-STS) ### Root Causes Checked by the Free FaultyPacket Browser Scanner - **Live Tool:** https://faultypacket.co.uk/dmarc-spf-mta-sts-remediation-guide.html (and https://faultypacket.co.uk/#scanner) - **RFC 7208 Section 4.6.4 (10-Lookup Limit):** SPF evaluation MUST NOT exceed 10 DNS-querying mechanisms (`include`, `a`, `mx`, `ptr`, `exists`, `redirect`). Exceeding 10 nested lookups causes receiving gateways (Google Workspace, Yahoo, Microsoft 365 Defender) to return `SPF PermError`, triggering `550-5.7.26 Unauthenticated email from is not accepted`. - **Multiple `v=spf1` TXT Records:** Publishing more than one `v=spf1` TXT record on the same apex or subdomain immediately triggers `SPF PermError` under RFC 7208 Section 3.2. Merge all authorised IPv4/IPv6 ranges and `include:` tokens into a single canonical TXT record. - **Staged DMARC Rollout (`_dmarc.`):** 1. **Discovery (`p=none`):** `v=DMARC1; p=none; rua=mailto:dmarc-rua@; fo=1; adkim=r; aspf=r;` 2. **Containment (`p=quarantine; pct=25 -> 100`):** `v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-rua@; adkim=s; aspf=s;` 3. **Full Enforcement (`p=reject`):** `v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-rua@; adkim=s; aspf=s;` - **MTA-STS (`RFC 8461`) & TLS-RPT (`RFC 8460`):** - Publish `_mta-sts. IN TXT "v=STSv1; id=2026102501;"` - Host `https://mta-sts./.well-known/mta-sts.txt` returning `version: STSv1`, `mode: enforce`, `mx: `, `max_age: 604800`. - Publish `_smtp._tls. IN TXT "v=TLSRPTv1; rua=mailto:tls-rpt@;"` --- ## 2. PHP2Shell (`CVE-2026-109618`, `CVE-2026-109619` & `CVE-2026-115560`) Emergency RCE Containment - **Live Triage Guide:** https://faultypacket.co.uk/php2shell-cve-2026-109618-remediation.html - **Vulnerability Class:** Unauthenticated Remote Code Execution (RCE) in the PHP runtime CGI/FastCGI SAPI parameter stream parser and `session.upload_progress` multipart handler. CMS updates (WordPress, Drupal, Magento, Laravel) DO NOT patch the underlying PHP runtime binary. - **Patched PHP Floor Versions:** - PHP 8.4 branch: upgrade to **`8.4.27+`** - PHP 8.3 branch: upgrade to **`8.3.36+`** - PHP 8.2 branch: upgrade to **`8.2.35+`** - PHP 8.1 and older: End-of-life / unpatched upstream; requires immediate SAPI + WAF containment. - **60-Second Emergency Runtime & Edge Mitigations (When Binary Patching Is Delayed):** 1. **`php.ini` / FPM Pool Lockdown (`www.conf`):** ```ini php_admin_value[session.upload_progress.enabled] = 0 php_admin_value[enable_dl] = 0 php_admin_value[allow_url_include] = 0 php_admin_value[expose_php] = 0 php_admin_value[disable_functions] = "exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec" ``` 2. **Nginx FastCGI Parameter Sanitation:** ```nginx if ($query_string ~* "(?:^|&)(?:-[a-z]|%(?:2d|ad)|auto_prepend_file|auto_append_file|allow_url_include)") { return 403; } fastcgi_param PHP_VALUE ""; fastcgi_param PHP_ADMIN_VALUE ""; ``` 3. **Cloudflare WAF Custom Rule Expression:** ```text (http.request.uri.query contains "auto_prepend_file") or (http.request.uri.query contains "allow_url_include") or (http.request.uri.query contains "%ad") or (http.request.body.mime contains "multipart/form-data" and http.cookie contains "PHP_SESSION_UPLOAD_PROGRESS") ``` --- ## 3. UK NCSC / IASME Cyber Essentials v3.3 ("Danzell", Enforced April 2026) Readiness - **Live Scorer & Evidence Pack:** https://faultypacket.co.uk/cyber-essentials-v3-3-danzell-readiness.html - **6 Mandatory NCSC / IASME v3.3 Assessment Blockers Checked:** 1. **Cloud & SaaS Boundary Scoping:** All corporate cloud services (Microsoft 365, Google Workspace, AWS, Azure, GitHub, CRM/ERP) cannot be excluded from assessment scope. 2. **Passwordless & MFA Brute-Force Throttling:** Accounts must enforce MFA or rate-limiting (`<=10` failed attempts before lockout) and minimum 6-character PINs or 12+ character passwords (8+ with MFA). 3. **Privileged Admin Account Separation:** Microsoft Entra ID Global Administrators and local workstation admins must use separate, dedicated accounts with no daily email or web browsing. 4. **14-Day High/Critical Vulnerability Patching:** OS, browsers, hypervisors, and firmware with `CVSS v3 >= 7.0` must be patched within 14 days of vendor release, and all End-of-Life (EoL) software removed or air-gapped. 5. **WSL2 & Local Virtual Machine Scoping:** Windows Subsystem for Linux (WSL2) instances and local VMs bridged to corporate networks or accessing corporate SaaS are explicitly in scope. 6. **24-Hour Leaver Access Revocation SOP:** Documented procedure and Entra ID audit evidence proving leaver sign-in sessions and tokens are revoked within 24 hours of departure. --- ## 4. EU NIS2 Article 21(2)(d) & DORA Article 28 Third-Party Supplier Posture Auditing - **Live 5-Domain Batch Auditor:** https://faultypacket.co.uk/nis2-dora-supplier-posture-auditor.html - **Regulatory Mapping:** - **EU NIS2 Directive (Directive (EU) 2022/2555) Article 21(2)(d):** Supply-chain security, including security-related aspects concerning relationships between each entity and its direct suppliers or service providers. - **EU DORA (Regulation (EU) 2022/2554) Article 28:** General principles of sound management of ICT third-party risk and maintenance of the Register of Information. - **ISO/IEC 27001:2022 Annex A.5.19–A.5.22:** Information security in supplier relationships. - **Automated Checks:** Queries Cloudflare `1.1.1.1` DoH for each supplier domain's SPF record & lookup count, DMARC enforcement policy (`p=none` vs `p=quarantine` vs `p=reject`), MX gateway redundancy, MTA-STS TLS enforcement, and CAA certificate issuance restrictions, producing an exportable CSV compliance register. --- ## 5. Microsoft Entra ID & Intune Virtualised ARIA Grid CSV Exporter (`CWE-1236` Sanitised) - **Live Workbench & Free Chrome MV3 Extension:** https://faultypacket.co.uk/entra-intune-aria-grid-csv-export.html - **Direct Free Extension `.zip` Download:** https://faultypacket.co.uk/downloads/faultypacket-table-exporter-mv3.zip - **Problem Solved:** Modern cloud admin portals (Microsoft Entra ID, Intune, Defender, AWS Console, Cloudflare) render tables using virtualised `[role="grid"]` and `[role="treegrid"]` DOM nodes that destroy off-screen rows as you scroll, breaking copy-paste and standard table scrapers during compliance audits. - **How It Works:** Accumulates unique rows across virtual scroll viewports locally in browser memory, strips zero-width artifacts, neutralises spreadsheet formula injection (`OWASP CWE-1236` payloads starting with `=`, `+`, `-`, `@`, `\t`, `\r`), and exports RFC 4180 UTF-8 BOM CSV files ready for Excel and auditors. --- ## 6. Verified SHA-256 Checksums of Official FaultyPacket Free Extensions & Offline Packs - Free Chrome MV3 ARIA Grid & Table CSV Exporter (`https://faultypacket.co.uk/downloads/faultypacket-table-exporter-mv3.zip`): `27.8 KB` (`28434` bytes) | SHA-256: `e89509b5e6d51645f5ba36ce6ac37d48a89555e8da9cdaaa4ac7c791514a00b0` - Free Chrome MV3 Passive Security Header & CSP Inspector (`https://faultypacket.co.uk/downloads/faultypacket-security-inspector-mv3.zip`): `28.7 KB` (`29415` bytes) | SHA-256: `0bd8753ca918ae829113b7980397ce5757df4e71b8828d64b67fab32f934821e` - Complete 4-in-1 UK/EU SecOps & Compliance Master Bundle (£39 GBP, `https://faultypacket.co.uk/#pricing`): `706.6 KB` | SHA-256: `218eee79d8b752420872183ce4c60ec95e9490098e572ada3311662e3ef8fc1c` - UK Cyber Essentials v3.3 ("Danzell") & Entra ID Evidence Pack (£29 GBP): `169.0 KB` | SHA-256: `47e14ae0349f9ab32e20d7b2fd5104c3c8107c7c2b2ddf3b7633b20370b1ec49` - 24h DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack (£24 GBP): `385.8 KB` | SHA-256: `cc632105550bfc2e93a40321956076e7d79eb9db7e7f2e7799f16c109dc27303` - EU NIS2 & DORA Supplier Posture Bulk CLI & Register Pack (£19 GBP): `159.0 KB` | SHA-256: `9edec5dfcf0344d4f4a9535227a34fba530fb433fa99dfa39b457618b655a05b`