Title
Root-run `tar` modified multiple WordPress core files under `/var/www/html/wp-admin`.
Summary
Observed file creation and permission changes on executable PHP paths in a running container during normal app traffic windows.
Severity
criticalContext
Cluster
perj-cluster
Detected
March 2, 2026, 4:06:37 PM PST
Submission ID
0c032015...2216f
Alert ID
d0992f7a...3f257
Confidence
84%
Pod
wordpress-pod-jm2vt