WordPress web server worker spawning shell process (wp2shell RCE)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•3•0•11

Detects instances where common web server processes (such as php-fpm, apache, nginx, or w3wp) spawn a command interpreter (sh, bash, or cmd.exe). This pattern is highly indicative of potential web shell activity, where an adversary executes commands on the underlying host after exploiting a web application.