How We Audited a High-Traffic WordPress Enterprise Stack on Google Cloud and Mitigated Cross-Site Scripting (XSS) in custom themes

Auditing a High-Traffic WordPress Enterprise Stack on Google Cloud

This post details the process of auditing a high-traffic WordPress enterprise deployment hosted on Google Cloud Platform (GCP), focusing on identifying and mitigating critical security vulnerabilities, specifically Cross-Site Scripting (XSS) within custom themes. The objective was to ensure the integrity, confidentiality, and availability of a system serving millions of requests daily.

Phase 1: Infrastructure and Configuration Review

The initial phase involved a deep dive into the GCP infrastructure and WordPress configuration. This wasn’t a superficial scan; it required understanding the interplay between managed services, custom deployments, and the WordPress core/plugin/theme ecosystem.

GCP Network and Security Posture

We began by examining the Virtual Private Cloud (VPC) network, firewall rules, and Identity and Access Management (IAM) policies. The goal was to identify overly permissive access, exposed services, and potential lateral movement vectors.

Key areas of focus included:

• Firewall Rules: Ensuring only necessary ports (e.g., 80, 443, 22 for bastion hosts) were open to the internet. Internal communication paths were also scrutinized.
• IAM Roles: Verifying that service accounts and user accounts had the principle of least privilege applied. For instance, a WordPress application service account should not have broad `editor` or `owner` roles.
• Load Balancing and WAF: Reviewing Google Cloud Load Balancing configurations and any integrated Web Application Firewall (WAF) rules (e.g., Cloud Armor policies) for effectiveness against common attack patterns.
• Secrets Management: Confirming that sensitive credentials (database passwords, API keys) were not hardcoded in application files but managed via GCP Secret Manager or similar secure mechanisms.

A common finding was the use of overly broad firewall rules, allowing SSH access from `0.0.0.0/0` to compute instances. This was rectified by restricting access to specific bastion host IP ranges or using IAP (Identity-Aware Proxy) for SSH access.

WordPress Deployment and Configuration

The WordPress deployment itself was analyzed. This included the web server configuration (Nginx in this case), PHP settings, and WordPress-specific configurations.

Nginx Configuration:

We reviewed the Nginx configuration files for security best practices. This involved checking for:

• Server Token Obfuscation: Hiding the Nginx version to prevent attackers from exploiting known vulnerabilities.
• Directory Listing Prevention: Disabling autoindex to prevent sensitive file enumeration.
• HTTP Strict Transport Security (HSTS): Ensuring HSTS headers were correctly configured for all subdomains.
• TLS/SSL Configuration: Verifying strong cipher suites and up-to-date TLS versions.
• Rate Limiting: Implementing basic rate limiting to mitigate brute-force attacks.

Example Nginx snippet for security hardening:

http {
    # ... other configurations ...

    server_tokens off; # Hide server version

    # ... other configurations ...

    server {
        listen 80;
        server_name example.com www.example.com;
        return 301 https://$host$request_uri; # Redirect HTTP to HTTPS
    }

    server {
        listen 443 ssl http2;
        server_name example.com www.example.com;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
        ssl_prefer_server_ciphers off;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_session_tickets off;

        # HSTS Header
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

        # Rate Limiting (example for login attempts)
        limit_req_zone $binary_remote_addr zone=login:10m rate=5r/min;
        location /wp-login.php {
            limit_req zone=login burst=10 nodelay;
            # ... other login specific configurations ...
        }

        # ... other server configurations ...
    }
}

PHP Configuration:

The php.ini settings were reviewed for security implications, particularly concerning file uploads, execution, and error reporting.

• expose_php = Off: Prevents the PHP version from being revealed in HTTP headers.
• display_errors = Off: Crucial for production environments to avoid leaking sensitive information. Errors should be logged to a file.
• allow_url_fopen = Off and allow_url_include = Off: Disables the ability to include remote files, preventing certain types of injection attacks.
• disable_functions: A curated list of dangerous functions that should be disabled (e.g., exec, shell_exec, system, passthru, popen, proc_open) unless absolutely necessary and carefully sandboxed.
• upload_max_filesize and post_max_size: Configured to reasonable limits to prevent denial-of-service via large uploads.

Example php.ini snippet:

[PHP]
expose_php = Off
display_errors = Off
log_errors = On
error_log = /var/log/php/php_errors.log
allow_url_fopen = Off
allow_url_include = Off
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait,pcntl_waitpid,pcntl_signal,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_wait