Web Shell Execution via PHP-FPM/Apache/Nginx Spawning Shell

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•5

Detects instances where web server worker processes such as php-fpm, apache, or nginx spawn shell interpreters (sh, bash, dash). This behavior is often indicative of web shell execution, where an adversary leverages a compromised web application to execute arbitrary commands on the underlying host.