All permissions corrected. The server now meets compliance standards. The attacker's foothold has been eliminated.