{"id":491,"date":"2026-04-03T17:26:26","date_gmt":"2026-04-03T17:26:26","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=491"},"modified":"2026-04-03T17:26:26","modified_gmt":"2026-04-03T17:26:26","slug":"microsoft-details-cookie-controlled-php-web-shells-persisting-via-cron-on-linux-servers","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=491","title":{"rendered":"Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 03, 2026<\/span><\/span>Linux \/ Server Hardening<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat\u00a0actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers and to achieve remote code execution, according to findings from the Microsoft Defender Security Research\u00a0Team.<\/p>\n

\u00abInstead of exposing command execution through URL parameters or request bodies, these web shells rely on threat actor-supplied cookie values to gate execution, pass instructions, and activate malicious functionality,\u00bb the tech\u00a0giant said<\/a>.<\/p>\n

The\u00a0approach offers added stealth as it allows malicious code to stay dormant during normal application execution and activate the web shell logic only when specific cookie values are present. This\u00a0behavior, Microsoft noted, extends to web requests, scheduled tasks, and trusted background\u00a0workers.<\/p>\n

The\u00a0malicious activity takes advantage of the fact that cookie values are available at runtime through\u00a0the $_COOKIE superglobal<\/a> variable, allowing attacker-supplied inputs to be consumed without additional parsing. What’s more, the technique is unlikely to raise any red flags as cookies blend into normal web traffic and reduce visibility.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The\u00a0cookie-controlled execution model comes in different implementations\u00a0–<\/p>\n