PHP/PHP-FPM process accessing /proc/self/mem (Chain B var_destroy UAF)

ills3c Intel&Coffee@Ills3C

•updated today•9•0•13

Detects PHP SAPI processes accessing /proc/self/mem (or equivalent memory mapping) and subsequently spawning a Unix shell, which is characteristic of web shell activity or exploitation of PHP memory corruption/injection vulnerabilities like zif_system.