PHP2Shell Web Server or PHP Worker Spawning Shell or Recon Utility on Linux

Suraj A@cytech

•updated yesterday•15•0•26

Detects web server worker processes (php-fpm, apache2, httpd, nginx) or PHP interpreters spawning shell or reconnaissance utilities (sh, bash, curl, wget, id, whoami), consistent with post-exploitation activity such as PHP2Shell remote code execution.