Threat actors abuse HTTP cookies as a covert control channel for PHP-based webshells on Linux shared hosting environments. These webshells do not expose command execution through visible URL parameters or request bodies but rely on attacker-supplied cookie values to activate malicious functionality. This cookie-controlled execution reduces visibility and logging, enabling persistent post-compromise access. Variants include loaders with layered obfuscation, direct cookie-driven payload staging, and cookie-gated interactive shells. Persistence is often achieved by registering cron jobs via legitimate hosting control panel interfaces, allowing recurring execution of malicious code within the account's isolated environment. This approach allows attackers to maintain access without root-level compromise and evade many traditional detection mechanisms.

The impact includes persistent unauthorized access to shared hosting accounts, enabling attackers to execute arbitrary PHP code stealthily. This can lead to data compromise, website defacement, or further lateral movement within the hosting environment. The use of cookie-controlled webshells reduces detection likelihood and complicates incident response. Although root access is not typically achieved, the attacker can maintain durable control over the compromised account and its web content. The low-and-slow activity pattern can delay discovery and remediation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation should focus on detecting and removing cookie-controlled webshells by monitoring for unusual cookie-triggered execution patterns and scheduled tasks within hosting accounts. Incident responders should investigate persistence mechanisms such as cron jobs registered via hosting control panels. Since this technique leverages legitimate account-level features, restricting and auditing user-level scheduled tasks and file modifications is recommended. Hosting providers should enhance monitoring for anomalous cookie usage and provide timely support to affected customers.