CWP2Shell PHP-FPM spawning shell with injected rm/sed/curl loopback commands

ills3c Intel&Coffee@Ills3C

•updated 7 days ago•6•0•8

Detects instances where a php-fpm process spawns a shell (sh, bash, dash) executing potentially malicious command patterns such as rm -f, sed -i with chained metacharacters, calls to the local CWP user API, or chmod on temporary files.