�� Attackers are using HTTP cookies to control PHP web shells on Linux servers.

Malware stays inactive and runs only when specific cookie values are sent, blending into normal traffic. Cron jobs can also recreate it for persistence.

�� How cookie-triggered web shells evade detection → https://thehackernews.com/2026/04/microsoft-details-cookie-controlled-php.html