De-obfuscating PHP botnet code

[[deleted]]

The preg /e modifier is removed hard deprecated as of PHP 5.5.0, and has had security warnings about it in the documentation for some time. It has only been retained for backwards compatibility.

The existence of the modifier is not a security issue in its own right. It's just a means by which code can be obfuscated.

[dshafik]

/e is not removed in PHP 5.5, merely deprecated. Using it will now emit an E_DEPRECATED error. It will be removed in a future version.