{{> header.html page_title="Running PHP Processes" header_widgets="" }} {{> threat/free_common.html }}
{{> threat/nav.html }}

Process audit {{+ proc_total }} processes

PHP processes running as the web-server user. This preview shows the known PHP processes BitFire can enumerate, but does not classify them yet. Long-lived non-FPM workers and unusual command paths still deserve a closer look.

{{#method_unavailable}}
Process enumeration unavailable

Unable to enumerate processes. /proc, exec(), popen(), and posix_kill() are all unavailable in this environment.

{{/method_unavailable}} {{^method_unavailable}}
Total
{{+ proc_total }}
running as web user
php-fpm
{{+ fpm_count }}
FPM workers
cli / script
{{+ cli_count }}
non-FPM PHP
Status
not checked
preview mode
{{#method_probe_only}}
Limited detection mode

Full process listing unavailable (/proc and popen not accessible). Showing only the PHP processes BitFire could identify from limited probing.

{{/method_probe_only}}
Detection {{- method }}
Preview only — processes below are listed as not checked.
Running

PHP processes {{+ proc_total }}

All PHP processes owned by UID {{+ my_uid }}. The current request is highlighted for reference. This preview lists the known PHP processes BitFire found, but does not assign pass/fail results yet.

{{ template:proc_row "data" }} {{ end template }} {{ render:proc_row "processes" }}
PID Command Runtime Memory Type Status
{{+ data.pid }}
{{- data.cmd_display }}
{{- data.runtime_display }} {{- data.mem_display }} Type: {{- data.type_label }} Status: not checked
{{#empty_visible}}

No PHP processes found.

No processes are currently running as the web-server user.

{{/empty_visible}}

Detection method: {{- method }} · PID {{+ my_pid }} (this request) · UID {{+ my_uid }}

Unlock Process Hunter in BitFire PRO

If you suspect PHP is still running from /tmp or another path outside your web root, BitFire PRO gives you the process-level view needed to confirm it.

Especially useful after repeated reinfections or when malware survives full plugin and theme replacement.
{{/method_unavailable}}