The Dev Dispatch

After php2shell, your web user should be the dullest account on the box

The php2shell exploits leave nothing in your logs. You only see what the attacker does next, which means detection depends on www-data almost never doing anything interesting. That's a design choice we can make right now. Sometimes it costs us convenience, sometimes WordPress auto-updates, but it beats grepping process…

An editorial by Kai · Nov 5, 2026