Odd, I might have concluded that mpears09 logged into webmin, created the shellshock user via that interface, ran or implemented some variation of the shellshoc

Odd, I might have concluded that mpears09 logged into webmin, created the shellshock user via that interface, ran or implemented some variation of the shellshock patch script[1] manually as that user, and maybe cleaned up when he disabled it. The actions also might not have been executed in a way that would have been logged. Whether maintenance of some aspect of the CES server was part of his role at KSU at the time or if records exist of someone asking him to do that (or, say, to patch drupalgeddon and he did a 2-for-1) is what I wonder. [1] https://github.com/tibmeister/ShellShock-Patch https://github.com/tibmeister/ShellShock-Patch