# World2050 (GT4IT "royal" lineage) — the women's/IVF build: health, IVF-usage depth, and what is different from Yahab/Glory

> **Source:** read-only examination on 2026-10-25 of `root@196.219.151.106` (cPanel host `196-219-151-106.cprapid.com`, AlmaLinux 9, MariaDB 10.11.11, account `world2050`).
> **Method:** `ls`/`grep`/`wc`/`file`/`du`/`stat` on the code; on the DBs only `SELECT` / `SHOW` / `information_schema` inside `SET SESSION TRANSACTION READ ONLY`, as root mysql CLI; HTTP checks were `curl -I` HEAD requests to entry/exposure URLs. **Nothing was written on the remote, no service was touched or restarted, no web UI was logged into, and no credential was printed or copied.** From configs only the DB *name* was read.
> **Privacy:** schema, lookup values, counts, date ranges and aggregates only. No patient data, no free-text notes, no staff names (distinct-user counts and role names only). Arabic stored as latin1 mojibake is decoded via `CONVERT(CAST(CONVERT(x USING latin1) AS BINARY) USING utf8mb4)`.
> Related: [`gt4it-ivf-systems.md`](gt4it-ivf-systems.md) (Yahab + Glory/Royal), [`legacy-ivf.md`](legacy-ivf.md) (Amr), [`moon-current.md`](moon-current.md) §3 (Moon gap list), [`global-benchmark.md`](global-benchmark.md).

## TL;DR (ملخص)
- **🔴 Security first — confirmed intrusion artefacts on the account.** The `lab.world2050.net` subdomain carries a user-agent-gated PHP backdoor wired into its front controller (present since **2025-03**, predating the ~May-2025 host build → **imported from the previous host**, consistent with a stale previous-host path still in the clinic code), plus a local-privilege-escalation toolkit and a web→shell wrapper **dropped 2025-06-12 — ~5 weeks after the move, i.e. on THIS host** (an attacker was active here, not merely restored baggage). Privilege escalation to root **most likely failed** (host polkit is the patched build; the dropped helper is not setuid; the cleanup the payload performs on success did not run) → assess as a **web-account-level compromise, not confirmed root**. This needs professional incident response by the owner; read-only here, nothing was changed or removed. Detail-free; see §D.
- **The clinic is live and very busy, and it IS a real IVF/fertility centre** (unlike Glory, which turned out cardiology). DB `world2050_obgy` (529 tables, 1.1 GB) was being written at 11:44 today. **~130k visits/yr, 2 branches (Mansoura + Port Said), 81.5k patients.** Departments over 365 d include women's clinic 44,657, main lab 28,871, **embryology lab 23,304**, operations 21,876, andrology 1,240, genetics 124. 74 distinct users logged in over 30 d.
- **This is the only one of the four GT4IT systems where the deep IVF lab suite is actually populated with production data** — and the "stray" 2023 cryo rows the [gt4it doc](gt4it-ivf-systems.md) found on the GT4IT dev server (`erpgt4it_royalnew`) turn out to be a **July-2023 copy of this clinic** (its `world2050_royaltest` holds the same 686 cryo placements, 257 Tank-A / 200 Tank-B, ending 2023-07-22 — a data-residency note for §D). Here the suite runs in two layers:
  - **Live, ongoing (daily, through yesterday): the structured folliculometry/stim module** `ivf_report`/`ivf_records`/`ivf_drugs` — **10,273 cycles 2022→2026**, 7,898 patients, typed trigger time on 98%, a real seeded protocol lookup, trigger drugs from the catalog. **This fork dropped Yahab's flat `icsi_fresh/frozen` grid entirely** and replaced it with this structured module.
  - **Used heavily in ~2023 then abandoned: the per-case embryology lab** `embryoslab` (1,097 cases, last 2023-10), `embryoscoring` (per-embryo-per-day, 10.5k rows), `embryotransfer` (425), `embryofreezing` (1,083), `embryothawing` (177, with survival), and the **cryo position map** `embryoslab_tank_cells` (966 placements, Tank A/B → canister → colour row → col → cell 1–10, 618 cases, Mar–Oct 2023). After ~Oct 2023 the clinic reverted to the lighter folliculometry + billing-only flow.
- **Features genuinely new vs Yahab/Glory:** (1) pregnancy **outcome is actually recorded** (≈40–53% +ve on ET/thaw billed visits — vs Yahab's 11/1,423); (2) **annual cryostorage renewal billing is live** (~4,100 embryo + ~2,100 semen renewals/yr — the commercial model Moon lacks); (3) **explicit sex-selection / PGT-A (PGS) / single-gene service catalogue** with matching Cryothawing variants and a "No XY" cancel reason; (4) a structured, seeded protocol lookup (not Glory's "1111" junk).
- **The LIS (`world2050_lab`, lab.world2050.net) is a dead stub** — 4 tables, just a PDF-result + SMS delivery front, last activity **2023-08-27**. Not a real LIS. (It is the compromised subdomain.)
- **Imminent ops risk:** `/home` is **100% full (13 GB free)**; a single `error_log` is **349 GB** and an `app.log` **7 GB**. Live DB dumps and multi-hundred-MB code zips are **publicly downloadable** over the cPanel userdir URL. PHP **5.6** (EOL) runs the clinic.

---

## A. «شغال ولا لأ؟» — health

### A.1 Reachability
Public DNS for `world2050.net` and `lab.world2050.net` resolves to **127.0.0.1** → the clinic is **not published on its own domain to the internet** (internal/LAN use). It is served through the cPanel **userdir** path and by `Host:` header to the IP:

| Entry | Result |
|---|---|
| `http://196.219.151.106/~world2050/royal/` | **302 → login** (clinic login page, 200) |
| `http://196.219.151.106/~world2050/erp/` | **302 → login** (ERP) |
| `https://lab.world2050.net/` (Host→IP) | **200** (LIS front; this is the compromised subdomain) |
| `http://196.219.151.106/~world2050/phpmyadmin/` | **200** (phpMyAdmin 4.9.11, 2023 — outdated, reachable) |
| `world2050.net` / `lab.world2050.net` over public DNS | resolve to 127.0.0.1 → not internet-exposed by name |

### A.2 Databases and verdicts
| DB | Tables / size | Role | Verdict | Evidence |
|---|---|---|---|---|
| **`world2050_obgy`** | 529 / 1,107 MB | the **royal clinic** (gyne + IVF) | ✅ **live, heavy** | written 11:44 today; visits by yr: 2022 99,768 · 2023 104,411 · 2024 121,680 · 2025 133,108 · **2026 116,244 YTD** (+73,165 NULL-dated legacy import); **11,480 visits/30 d, 2,714/7 d**; patients 81,558 (+1,185/30 d); **74 users/30 d** |
| **`world2050_erp`** | 296 / 3,251 MB | the ERP (stock/finance) | ✅ live | nightly dump `world2050_erp_2026-10-25.sql` 00:09 today |
| `world2050_royaltest` | 519 / 366 MB | **July-2023 copy of the live clinic, real patient data** (37k patients, 265k visits, 686 cryo placements) | ⚠️ stale copy = the "stray" rows the gt4it doc saw on the GT4IT dev server | last visit write 2023-07-22; table meta touched 2025-05 |
| `world2050_22` / `_222` / `_223` | 295 each / ~2 GB each | idle ERP-schema copies (no `visits`/`embryoslab`) | 💤 | no `update_time` |
| `world2050_erp14-7-2023` | 284 / 435 MB | old ERP snapshot | 💤 | — |
| `world2050_siam` | 290 / 1,759 MB | the `siam` ERP (separate business) | 💤 idle | last 2025-05-09 |
| **`world2050_lab`** | 4 / 11 MB | the "LIS" (lab.world2050.net) | 💤 **dead stub** | only `patients`/`tests`/`prescriptions`/`visits_sms`; 49,507 tests but **all 2022→2023-08-27**, then stopped. It is a PDF+SMS result-delivery front, not a LIS |

**It is genuinely an IVF centre** (the owner's "نسخة النسا فيها شغل على IVF" is correct). Departments over 365 d (via `visits.for_department → awrole`): women's clinic 44,657, main lab 28,871, **embryology lab (معمل الأجنة) 23,304**, operations 21,876, other-services 12,296, new-cases 5,931, radiology 2,544, **andrology (عياده الذكوره) 1,240**, pediatrics 633, **genetics (الوراثة) 124**, nutrition 50. Branches: Mansoura (10,865 visits/30 d) + Port Said (841/30 d).

### A.3 Runtime
- Clinic docroot runs **`alt-php56` / ea-php56** (session path `/var/cpanel/php/sessions/alt-php56`); the `lab` subdomain runs **ea-php80**. PHP 5.6 EOL since 2018.
- Text stored as **latin1 mojibake** (same as the other GT4IT systems) — matters for any migration.
- Framework is the same **"aw" family** (RedBean + Smarty, generic `append`/`update`-by-POST-tablename endpoints).

### A.4 Logs and disk (ops risk)
| Item | Size / state |
|---|---|
| `royal/core/controllers/error_log` | **349 GB**, written now — mostly repeating PHP 5.6 warnings (`in_array()`/`foreach` null, `uploadingFile()` missing arg) + a backup `fopen()` to a **stale previous-host path** `/var/www/htmlerp/...` that fails every run |
| `royal/logs/app.log` | **7.0 GB** (request audit, `ions.INFO`) |
| `erp/controllers/error_log` | 114 MB |
| **`/home` filesystem** | **1.9 TB, 100 % used, 13 GB free** — `.trash` 586 GB, `royal/core/controllers` 326 GB (the error_log), `royal/upload` 91 GB. **Imminent outage risk.** |

### A.5 Backups (⚠️ owner, not Moon)
- **App-level nightly dumps run and are fresh:** `royal/core/db_backups/opgy_2026-10-25.sql` (1.1 GB, 00:03 today), `erp/db_backups/world2050_erp_2026-10-25.sql` (3.1 GB, 00:09 today). (`opgy_*` is mislabelled — content is `world2050_obgy`.) 21 daily files kept.
- **Off-disk:** a root cron `send_core_backup_direct.sh` (every 2 days) pushes those dumps to a remote **SMB/NAS** share via `smbclient` — **the SMB password sits in plaintext in the script** (root:root, 0755 = world-readable). `NASBACKUP`/`NASBACKUP_DEST` staging dirs are **empty since 2026-05-02** (the new script bypasses them).
- **cPanel account backup** to `/home/cpbackup` (daily `0,2,4,6`): `world2050.tar.gz` ≈ 149 GB, **last good 2026-10-10**, and dated dirs stop at 10-10 (today is 10-25) → **cPanel account backups appear to be failing, almost certainly because the disk is full.**

---

## B. IVF usage depth (what is actually filled)

Two layers coexist. **Layer 1 (folliculometry) is the live, ongoing IVF record.** **Layer 2 (the deep lab suite) was used in 2023 and then abandoned.** The Yahab flat `icsi_fresh/icsi_frozen` grid **does not exist** in this DB.

### B.1 Layer 1 — folliculometry / stim monitoring (LIVE, daily)
| Table | Rows | Range | Last | Recent |
|---|---|---|---|---|
| `ivf_report` (one per cycle: protocol, trial, BMI, AMH, FSH, **trig_date + trig_time**, doctor, completed) | 10,273 (432 del) | 2022-12 → **2026-10-24** | yesterday | 157/30 d, 1,850/365 d; 7,898 patients |
| `ivf_records` (per scan: cycle_day, E2, R/L no+size, endo) | 15,738 | 2022-12 → 2026-10-24 | yesterday | 315/30 d; ~1.6 scans/cycle |
| `ivf_drugs` (per cycle) / `ivf_records_drugs` (per scan) | 8,933 / 34,612 | → 2026-10-24 | yesterday | from `drugs` catalog |

Cycles/yr: 2023 3,560 · 2024 2,814 · 2025 1,961 · 2026 1,477 (YTD) — a declining but still-daily module.

**Fill (last 365 d, n≈1,813):** protocol **92%**, AMH 62%, FSH 58%, BMI 55%, trial_no 53%, **trig_time 98%**, trig_date 39%, completed 93%, doctor 99%.
- **Protocol lookup is real and seeded** (`treatprotocol`, 18 rows): antagonist 3,548, simple 1,412, long-agonist 614, long 379, agonist 69… — **not** Glory's "1111/2222" junk.
- **Trigger time** is near-universally typed but **~half are round/default values** (minute∈{00,30} on ~4,577; 02:00 ×396, 22:00 ×1,026; ~4,724 within 2 min of the row's create-time). So it is *used* far more than Yahab (0) but is partly auto-defaulted — a real datetime picker in Moon should default-to-now yet read clearly editable. (The `trig_date − create_date` split is bimodal: a −2 d mode = the cycle row opened retrospectively at OPU, and a +9/10 d mode = opened at cycle start — which is why trig_time ≈ create-time on roughly half the rows.)
- **Drugs** reference the catalog with an `ivf_show` flag (374 drugs flagged): trigger drugs dominate (choriomon 2,638, Ovitrelle 2,637, Epifasi, Decapeptyl). **No stock integration** — only 7 drugs carry any balance.
- **Per-scan follicle data is free text**, not per-follicle: `r_size` = "9mm" / "9-9mm" / "9*9mm" patterns (structured per-follicle counts absent); `e2` numeric on 8,659 of 15,738; `endo` mostly empty; `cycle_day` often carries Arabic staff names. So monitoring is a light register, not a structured follicle matrix.

### B.2 Layer 2 — the embryology lab suite (USED 2023, then abandoned)
| Stage | Table | Rows | Range (last) | Notes on fill |
|---|---|---|---|---|
| Embryology lab case | `embryoslab` | 1,097 (540 cancelled) | 2021 → **2023-10-08** | per non-cancelled case (n=557): no_oocyte 79% (avg 13.7), MII numeric 75% (avg 8.6), fertilized 79%, **visit_id 94% (billing link)**, embryologist 79%, ICSI-by 62%, oocyte_activation 4%; **media 2%, incubator 1%, lot_no 0%, lot_exp 0%, kit_no 22%** → traceability fields present but **not filled**; oocyte quality/zona/cytoplasm ~1–2% |
| Per-embryo × day | `embryoscoring` (stage/grade/media/oil/incubator/embryologist × D1–6, one row per embryo) | 10,478 | (last 2023-10) | **11.2 embryos/case**; stage filled **D2 50%**, D3 7%, D4 7%, D5 4%, D6 0.1% (D1 ~0%) → scoring starts at the fertilization/cleavage check; D5 grade (Gardner codes) only ~3% |
| Embryo transfer | `embryotransfer` | 425 | 2023-10 | et_day 95% (D4 171/D3 112/D5 111); embryos transferred: 2 on 168, 3 on 163; catheter/difficulty/blood/jet/LAH ~0–5% |
| Embryo freezing | `embryofreezing` (per straw, stage/grade) | 1,083 | 2023-10 | 1.6 straws/case, 680 cases |
| **Cryo map** | `embryoslab_tank_cells` (location A/B → btn/canister → row → col → cell 1–10) + `tanks_general` (43 canisters, 9 colour rows) | 966 (55 del) | **2023-03-26 → 2023-10-08** | **618 cases placed**; Tank A 427 + B 484; older `tankcells` model 2,000 cells + `tankcellhistory` 23 add/remove events (2022) |
| Thaw / FET | `embryothawing` (recovered/lost survival, → `embryofreezing_id`) | 177 | 2023-08 | survival ≈ 96% (recovered 466 / 485); links to a freezing report, not a specific straw |
| OPU sheet | `ovumpickup` | **6** | 2024-08 | the dedicated OPU sheet is effectively unused… |
| Operation record | `followup_operation` + `manual_operation` | 34,054 / 66,340 | **2026-10-25 (today)** | …because **OPU/ET are recorded as general operations** (billing service + operation follow-up), not via `ovumpickup`. 590 operation follow-ups in 30 d |
| Andrology | `semen` (flat seminogram) | 6,853 | 2021 → 2026-10 | peaked 2022 (2,787), 2023 1,529, then **collapsed** (2024 73, 2025 237, 2026 2); `for_husband` used from 2023 |
| Andrology (deep) | `sperm_extract` (TESE/PESA) 14, `spermfreezingreport` 9, `semen_analysis/cryo/processing` 3/4/3 | trial only | 2022–2025 | the `ivf_reports` LIS-style andrology was only ever trialled |
| Prior-ICSI mini grid | `phpasticsi` | 135 | — | opu/GII/GI/GV/ET/bHCG/FHR, mostly empty |

**Grading lookups are real (not junk) but ad-hoc:** `grade` (60 rows) mixes Gardner-ish codes ("5AA", "4BB", "5BB XY") with bare numbers; `stage` (397 rows) holds "blastocyst / Morula / 8cell / EBL / BL(XY)" with **sex tags embedded**. `cancel_reason` (12 rows) is clinically meaningful: Freeze-All 435, Arrested 33, **No XY 22**, oocyte-freezing 13, No-fertilization 12. `cancelled` carries cancel + reverse user audit.

### B.3 Outcome, KPIs, billing, consents
- **Outcome IS recorded** — coded `visits.result` (1 = +ve, 2 = −ve) on the ET/thaw **billed** visit (confirmed in `ivf_reports.php`). Over 365 d: Cryothawing 2,006 results (1,066 +ve / 940 −ve ≈ **53%**), E.T 776 (307/469 ≈ **40%**), Cryothawing-Sex-Selection 509 (238/271). This is a **real pregnancy signal** — the sharpest difference from Yahab (fresh preg 11/1,423).
- **KPI report** (`ivf_reports.php::icsi_cases_report` / `icsi_casesSearch2`) computes EC/ET/cancelled/pregnant/blast split by **oocyte band (<5 / 5–15 / >15)** and **age band (<35 / 35–39 / ≥40)** + cancel-reason counts — the same code as Glory, **but here it has data to run on**. Counts only, no rates.
- **Billing — a rich IVF catalogue** (vs Yahab's 3 services): E.C 28,000 EGP ×2,555/365 d, **E.C.Sex-Selection** ×979, E.C.PGS/Single-Gene, E.C Oocyte-freezing 15,000, E.C+PRP, PICSI; Cryothawing ×2,174 + Sex-Selection ×555 + PGS/Single-Gene; Embryo-freezing 5,000 ×2,844; **sperm/oocyte/testicular-sample freezing**. Prices are per-service catalogue values (real, non-zero).
- **Sex-selection / PGT usage (share of the EC/thaw families, 365 d):** of 3,709 egg-collection visits, **Sex-Selection 26% (979)**, PGS+Single-Gene 1.7% (64), oocyte-freezing 2.6% (98); of 2,777 Cryothawing visits, **Sex-Selection 20% (555)**, PGS+Single-Gene ~1.7% (48). Sex selection is a mainstream offering here, PGT a niche.
- **Annual cryostorage renewal is a live revenue line** (billing-only, no contract/expiry table): embryo-storage renewal **4,111/365 d**, semen renewal 2,109, testicular-sample renewal 240, oocyte renewal 108; **avg 1.68 renewals/patient, ~295-day gap** (≈ annual). `embryoslab.visit_id` ties the lab case to its paid visit; `detections.for_embryo` flag set on 12 of 382 services.
- **ERP link is weak now:** `bill_paying.erp_save*` = 0 of 779 in 30 d; `visits.clientdeptchangeid_save` set on 2,284 of 11,707 → the clinic→ERP financial bridge is mostly off.
- **Consents:** `decleration` 2 rows, `patientdecleration` 0 → **no IVF/freezing/disposal consents** (gap stands).

---

## C. Comparison and impact on the Moon WP plan

### C.1 Where this system sits in the lineage
| | Amr obgy | Yahab (live) | Glory/Royal (code) | **World2050 royal (this)** |
|---|---|---|---|---|
| Live IVF layer | `ivfsheet` (flat, 615) | `icsi_fresh/frozen` (flat grid, 2,161) | none (0 rows) | **structured `ivf_report` folliculometry (10,273), daily** |
| Deep lab suite in use | no | 1 trial row | 0 rows | **yes in 2023** (986 lab cases, 10.5k embryo-scores, 618 cryo placements, 177 thaws), then abandoned |
| Outcome capture | free text | 11/1,423 (none) | — | **coded on billed visit, ~40–53% +ve** |
| Cryostorage renewal | no | no | no | **live annual billing (~6k renewals/yr)** |
| Sex-selection / PGT | free text | free text 18% | lookups (junk) | **coded services — sex-selection 26% of EC / 20% of thaw, PGT ~1.7%; + "No XY" cancel reason + stage/grade sex tags** |
| Scale | — | ~20k visits/yr | cardiology | **~130k visits/yr, 2 branches, full fertility hospital** |

**Key correction to the gt4it note:** the deep lab suite is **not** "never used in production" across the lineage — **World2050 proves it works in a real Egyptian ICSI centre** (618 cryo placements, 10k embryo scores), and the "stray" 2023 rows the gt4it doc saw on the GT4IT dev server were a July-2023 copy of *this* clinic's data (686 placements in `world2050_royaltest`). But it also proves the **adoption risk**: the clinic used it intensively for ~7 months in 2023 then reverted to the lighter folliculometry + billing flow, and even while using it left media/incubator/lot/expiry and oocyte-quality fields ~1–2% filled. Counts (oocyte/MII/fertilised) stayed ~80% filled.

### C.2 Against Moon's gap list (`moon-current.md` §3) — deltas vs the gt4it analysis
| Moon gap | New evidence here | Take-away for Moon |
|---|---|---|
| Per-embryo D1–6 grading/fate | **used** (11 embryos/case, stage+grade per day), but blast-day scoring sparse and grading lookup ad-hoc | adopt row-per-embryo-per-day; **ship a seeded Gardner/Istanbul scheme** (their lookup drifted into free codes); keep D5/D6 optional |
| Media/dish/incubator + lot/expiry traceability | fields **exist and were ignored** (~1–2% filled) | traceability only works if auto-filled from an Inventory lot scan; **do not rely on manual entry** |
| Cryobank tank→canister→cane→straw + move history | **populated** (618 cases, colour grid, add/remove history) | strongest validated idea — reuse the **visual colour-coded picker + move log**; add straw/device IDs + LN₂ log |
| Storage contracts / fees / renewal | **renewal billed annually at scale** (billing-only) | **build it as a first-class contract (expiry + auto-renewal invoice)** — proven demand (thousands/yr); Moon's commercial differentiator |
| Thaw survival (recovered/lost) | **used**, ~96% survival captured | adopt; link thaw to the specific straw/position (here it links to a freezing *report*) |
| KPIs by oocyte/age band | code **and data** present | adopt the band splits as defaults; **add the rates Moon already plans** (fert/blast/CPR/LBR/cumulative) |
| Outcome capture | coded on the **billed** ET/thaw visit | Moon's cycle-scoped outcome is better; but **migration must read outcome off the FET/thaw billing visit** |
| Sex-selection / PGT | **first-class services + cancel reason** | must be coded (owner/legal decision for Egypt) — demand is explicit here |
| Typed trigger datetime | 98% filled but ~half defaulted | real datetime picker, default-now but clearly editable |
| Embryologist / andrologist role | `embryologist` role + lab roles exist and used | Moon needs the role (still missing) |
| Consents, LIS link, drug stock | still absent / weak (LIS is a dead PDF stub; no drug stock; no consents) | Moon's gaps stand; Moon's real LIS + Inventory are already ahead |

### C.3 What changes the plan
1. **Raise confidence** in building the per-case embryology + per-embryo-day + cryo-map modules — they are field-proven, not theoretical.
2. **Lead with the two-speed UX and auto-fill**: the abandonment + the empty traceability fields are the warning. Counts-first (Moon's current approach) is validated; deep structure must be fast/auto or users route around it.
3. **Promote cryostorage renewal to a first-class billable contract** (expiry, reminder, auto-invoice) — this is live recurring revenue here and absent from Moon.
4. **Treat outcome-on-billed-visit as the migration source** for any World2050/Yahab import.

---

## D. Security (class-level, no exploit detail) — ⚠️ for the owner

1. **Confirmed intrusion artefacts** under `lab.world2050.net`: a **user-agent-gated PHP backdoor** included by the subdomain's own front controller (mtime **2025-03**, predating the host build → **imported from the previous host**, consistent with the stale `/var/www/htmlerp/...` path still in the clinic code), and a dropped **local-privilege-escalation toolkit + a web-request→shell wrapper** (mtime **2025-06-12 — ~5 weeks after this host was built**, so planted *here*: an attacker was active on this host). The host was built/migrated **~2025-05-08/09** (`cpmove_failed_mysql_dbs.*` epochs decode to those dates; `.user.ini`/`php.ini`, the `sys` schema, and the idle DB copies all stamp 2025-05). A separate **2026-04-30 account-wide restore/relocation** reset ctimes across the home (docroot `.htaccess`, logs) — that is *not* the migration date. **Privilege escalation most likely failed** (host `polkit` is the patched build; the dropped helper is not setuid; the on-success cleanup the payload performs did not run, and its staging dirs still exist) → **web-account-level compromise, not confirmed root.** Nothing was neutralised (read-only). **Owner action: professional IR, rotate all account/DB/SMB credentials, rebuild or quarantine the `lab` subdomain.**
2. **Live DB dumps and code archives are publicly downloadable** over the userdir URL (HTTP 200): the 1.1 GB clinic dump, the 3 GB ERP dump, and multi-hundred-MB code zips (`erp/11-5-25.zip`, `royal/core/controllers.zip`, `siam/erp.rar`), plus `royal/logs/app.log`. `db_backups/` and `upload/` directory listings are 403, but **individual `.sql` files inside are 200**. A dev helper (`erp/controllers/_tst.php`) executes. **Recommend: move these off the docroot.**
3. **`phpMyAdmin 4.9.11` (2023)** is present and served (200) at the userdir path — outdated and internet-adjacent.
4. **Generic request-driven writes**: the same "aw" framework family as the other GT4IT systems (table/column names taken from the request in `append`/`update`; soft-delete by request value). Same vulnerability *class* as documented in `gt4it-ivf-systems.md` §1.4 — not re-audited controller-by-controller here.
5. **PHP 5.6** (EOL 2018) runs the clinic; `lab` runs PHP 8.0.
6. **Secrets in files**: the SMB backup password is in plaintext in a world-readable root script (`/usr/local/bin/send_core_backup_direct.sh`).
7. **Disk at 100%** is itself a reliability/security risk — it is already breaking cPanel account backups (last good 2026-10-10) and can take the clinic offline.

8. **Data residency:** a July-2023 copy of this clinic's full patient data lives in `world2050_royaltest` here **and** on the separate GT4IT dev server (`server1.royalgt4.com`, as `erpgt4it_royalnew` — see the gt4it doc). Real patient data has been copied between vendor servers. Also `world2050_royaltest` (37k patients) is a reachable copy on this same host.

Note: the clinic/ERP apps themselves are **not published on their public domains** (DNS → 127.0.0.1); exposure is via the cPanel userdir URL and the IP. The compromised surface is the `lab` subdomain.

## 2026-10-25 — action taken (owner: «امسح ملف الإيرور الكبير علشان يفضّي مساحة»)
- `royal/core/controllers/error_log` (325 GB, still being written) **truncated in place** (`: >`, inode kept). /home went 100% (13 GB free) → 83% (338 GB free).
- Evidence kept first (server is compromised): `/root/forensics-2026-10-25/royal_error_log_tail_1G.gz` (last 1 GB) + `royal_error_log_head_300K.gz` (root-only, on the root FS).
- Flood cause (last 20 MB sample): mostly `readdir() expects parameter 1 to be resource` in `royal/core/controllers/patients.php`, then `in_array()` null in `invsdept_common.php`, tcpdf foreach, `uploadingFile()` missing arg. Until fixed (or log rotation/limits) the file refills. `royal/logs/app.log` (6.5 GB) not touched.