PHP2Shell Post-Exploitation Persistence and Reverse Shell from Web Server Proces

Suraj A@cytech

•updated yesterday•11•0•14

Detects post-exploitation activity following PHP2Shell RCE vulnerabilities on Linux, where a web server or PHP worker process or web server user creates cron persistence, modifies SSH authorized_keys, or launches reverse shell one-liners.