Microsoft Exposes Cookie-Controlled PHP Web Shells That Resurrect Themselves via Cron — A New Stealthy Linux Persistence Technique

Traditional PHP web shells expose their command execution functionality through URL parameters or HTTP request bodies — making them detectable through standard web application firewall rules, log analysis, and file integrity monitoring. This technique takes a fundamentally different approach that exploits a simple but powerful property of PHP: the $_COOKIE superglobal variable, which makes HTTP cookie values available to PHP code at runtime without any additional parsing or input handling. Threat actors deploy PHP loaders that contain no obvious malicious functionality in their static code — the entire execution logic is gated behind a cookie value check. When a normal user or security scanner visits the page, the PHP loader does nothing. When the attacker sends a request with the specific cookie value they control, the web shell activates, processes commands, and can write secondary payloads to disk — all while appearing as ordinary PHP execution in the web server logs. This cookie-based gating means the web shell's network security footprint is minimal and its information security impact can go undetected for extended periods. Microsoft noted that this behavior extends beyond simple web requests to scheduled tasks and trusted background workers, creating multiple activation pathways that compound the detection challenge.

The digital security and data security implications of this technique are significant for any organisation running PHP applications on Linux hosting infrastructure. Shared hosting environments are particularly vulnerable because tenant isolation is only as strong as the account boundary — a compromised hosting account can be used to deploy web shells that affect all web properties hosted under that account. The technique does not require the attacker to have root-level server access, which means it operates below the detection threshold of many server-level security monitoring tools that focus on system-level changes. From a computer security perspective, the persistent RCE channel established by this technique gives attackers ongoing access to the compromised web application — the ability to read and modify web content, exfiltrate data processed by the application, harvest credentials submitted through forms, inject malicious code into pages served to users, and use the compromised server as a pivot point for further attacks on connected systems. Microsoft emphasised that the consistent reuse of cookie-based control across multiple observed implementations suggests this is established web shell tradecraft being shared and reused across different threat actors rather than a technique unique to a single campaign.