Sendmail Invocation via Shell Spawned by Web Server from Anomalous wp2shell Plugin Directory

Duo Tech@duotech

•updated Jul 23, 2026•0•0•9

Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.