PHP2Shell Apache mod_php worker spawning sh -c via system() at request shutdown

Suraj A@cytech

•updated 4 days ago•1•0•1

Detects web server or PHP worker processes spawning a shell (sh, bash, dash) with the -c parameter under web user accounts, potentially indicating code execution or webshell activity such as the PHP2Shell fake-array destructor hijack.