Recently, I was passed some error logs to take a look into, since we'd had some network spikes recently. However, I've never worked with modsecurity (I'm a programmer just doing this since we don't have a real sysadmin), and something alarming came up.
ModSecurity: Access denied with code 503 (phase 2). Pattern match --cut-- [line "23"] [id "390144"] [rev "2"] [msg "Command shell attack: Generic Attempt to remote include command shell"] [severity "CRITICAL"]
The words critical, command shell, and attack are probably not something good. I think "remote include command shell" meant a hacker was trying to pull up a shell without authorization, but that's more of a guess than anything.
Can someone tell me what's going on here, or link to some documentation I should read? Would the frequency of entries mean anything?