PHP FastCGI worker one-liner write-execute-delete of temp PHP file (!notwrtbl!)

Suraj A@cytech

•updated 4 days ago•2•0•10

Detects a PHP FastCGI worker (such as php-cgi, php-fpm) spawning a PHP one-liner or shell interpreter executing code that writes, executes, and deletes a temporary PHP file. This pattern is characteristic of web shells or remote code execution exploitation.