PHP2Shell two-stage multipart exploitation: OOM fatal then worker crash
Detects a sequence where a PHP or web worker process crashes, followed by the same worker lineage spawning a shell on the same device within a 15-minute timeframe, which can be indicative of stale-pointer corruption leading to remote code execution.
Microsoft Sentinel (KQL)
