ROLLOUT-RUNBOOK.md

Rollout Runbook: Count → Block

This is how you'd roll the virtual patch out to production safely. In this lab each step is one Terraform variable.

Step	Action	How in this repo	Exit criteria
0	Inventory PHP versions, SAPIs (mod_php, FPM, FrankenPHP, LSAPI) and endpoints that accept bodies	index.php shows the live version and settings	Every PHP host known; upload endpoints listed
1	Turn on WAF logging before changing rules	aws_wafv2_web_acl_logging_configuration is created with the ACL	Logs arriving in aws-waf-logs-php2shell-shield
2	Confirm the PHP rule group is on Version_2.3 (or default), with no group-wide Count override	scripts/verify-waf.sh	Version_2.3, GroupOverride: None
3	Deploy all custom rules and PHP2Shell_BODY in Count	rule_mode = "count" (default) → terraform apply	Rules visible in console
4	Review for hours, not days: dashboard, sampled requests, saved query 03-count-mode-would-block	tests/validate.sh --mode count produces sample matches	No legitimate paths in the would-block list
5	Handle false positives	Upload path → upload_path. PHP2Shell_BODY FP → php2shell_exempt_path (label exception, rule 40)	FP path scoped as narrowly as possible, patched first
6	Switch to Block	rule_mode = "block" → terraform apply	tests/validate.sh --mode block → 8/8 pass
7	Patch PHP and harden php.ini in parallel	php_image, app/php/*	All hosts on fixed releases
8	Decide what stays after patching	Keep rule 60 where no uploads exist; keep upload_progress off	Decision recorded

Rollback

• Don't roll the PHP rule group back to Version_2.2. That version lacks PHP2Shell_BODY, so the CVE-2026-109619 protection silently disappears. variables.tf rejects anything below Version_2.3.
• If something legitimate breaks, set rule_mode = "count" (everything keeps logging), or add a narrow php2shell_exempt_path.

Alerting

php2shell-shield-php2shell-activity alarms on any PHP2Shell match, counted or blocked, so it also catches probes during the Count window. Set alert_email to get the SNS notification.