How-To: Catch a PHP Web Worker Spawning a Shell

CISA’s PHP2Shell guidance says to watch for PHP worker processes launching shells. That’s a good habit for any PHP site, WordPress included, so here’s a generic way to do it on a Debian or Ubuntu box. This is detection, not a fix. Patch PHP first.

1. Eyeball the process tree

A PHP worker should almost never have a shell as a child:

ps -eo pid,ppid,user,etime,cmd --forest | grep -A3 -E 'php-fpm|apache2' | grep -E 'sh -c|bash|/sh '

2. Log every program the web user runs

Install auditd and add a rule for the web server user (www-data is usually UID 33 on Debian; check with id www-data):

sudo apt install auditd
sudo auditctl -a always,exit -F arch=b64 -S execve -F uid=33 -k web_exec
sudo ausearch -k web_exec -i --start today | grep -E 'comm=|exe='

Make it permanent by putting the same rule (without auditctl) in /etc/audit/rules.d/web.rules.

3. Shrink what PHP can launch

In your PHP-FPM pool file, you can block the shell functions most sites never need:

php_admin_value[disable_functions] = exec,passthru,shell_exec,system,proc_open,popen

Test on staging first. Some plugins and image tools do need these.

4. Act on a hit

• Take the site offline or put it behind maintenance mode.
• Patch, rotate passwords and keys, and check for new admin users and changed files.

Use the Source!

References & Further Reading

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• auditctl(8) man page
• ausearch(8) man page
• PHP-FPM configuration (PHP Manual)