Apache CVE-2021-41773/42013 traversal to /bin/sh with wget/curl dropper

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects web server processes (Apache httpd, apache2, php-cgi, php-fpm) spawning a Unix shell (sh, bash, dash) that executes a wget or curl command piped directly into the shell for execution, indicative of potential remote code execution or web shell activity.