PHPsert
- ID
- S9028
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
PHPsert is a webshell used to execute PHP code that has been in use since at least 2023 against targets in Japan, Singapore, Peru, Taiwan, Iran, Republic of Korea, and the Philippines. PHPsert is not typically deployed as a standalone but integrated into web content such as text editors and content management systems.[1]
Techniques used (6)
- T1027.013 Encrypted/Encoded File
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1505.003 Web Shell