PHP2Shell Multipart POST Spikes and Direct-to-Origin Requests Bypassing WAF

Suraj A@cytech

•updated 4 days ago•1•0•2

Detects a high volume of HTTP POST requests targeting .php endpoints directly on an IIS server without routing through a CDN or WAF, identified by missing X-Forwarded-For headers or empty user agents.