Apache mod_php is an Apache module that embeds the PHP interpreter in the web server process. When Apache receives a request for a PHP script, the module executes it and returns the result as part of the HTTP response. This differs from setups where Apache passes PHP work to a separate service, such as PHP-FPM.
The execution model matters for security because PHP code runs with the privileges and environment of the Apache worker. If an attacker exploits a PHP application or interpreter flaw, they may be able to make that worker perform unintended actions, potentially including launching operating-system commands. Defenders should keep PHP and Apache components patched, limit the web server account’s permissions, and monitor for unusual child processes. A shell spawned by an Apache worker can indicate serious compromise, though its presence in a honeypot demonstrates activity in that decoy environment-not compromise of production systems.