auditd

How-To: Catch a PHP Web Worker Spawning a Shell

CISA’s PHP2Shell guidance says to watch for PHP worker processes launching shells. That’s a good habit for any PHP site, WordPress included, so here’s a generic…