What It Checks

PHP2Shell

Check	What it looks for	Severity
PHP version	The version your website runs — not just the command line's — against the fixed releases	Critical / High / Medium → Vulnerable or Needs review
OS packages	The installed Ubuntu/Debian package version against the first fixed build; other distributions that may carry the fix without a new version number	High (known-unfixed package) · Info (fixed package) · Medium ("ask your host")
Build date	PHP built after the fix was published (October 21, 2026), from the date on PHP’s own files	Medium ("probably patched — confirm")
Riskiest setup	Apache mod_php, which researchers rate highest-risk	Noted in the finding
Temporary protections	session.upload_progress.enabled, memory_limit, fatal_error_backtraces, post_max_size, max_input_nesting_level. They make attacks harder, not impossible — only a patched PHP fixes it	Info
PHP history	Whether this site ran an unpatched PHP after October 17, 2026, even if it's patched now	Medium — change your passwords and keys
CVE-2026-115560	Session upload progress turned on. PHP's October 23 advisory for this related flaw (no fix in any version yet) asks for it to be off — shown even on patched PHP	Info
PHP error log	Allowed memory size … exhausted … in Unknown on line 0 (out-of-memory before any script ran — the tell-tale sign), Maximum execution time … exceeded in Unknown on line 0, Failed to decode session object, worker crashes (SIGSEGV, Apache AH00052 … exit signal Segmentation fault (11) or Abort (6), heap corruption) since October 17	Medium; High for bursts or crashes
	Out-of-memory errors even though memory_limit = -1 (they should be impossible)	High
Access log	Bursts of POST requests answered with HTTP 500/502 from one address since October 17	Medium (a lead, not proof)
	The public exploit and scanner tools (php2shell-scan, php2shell-verify, php2shell-109618, JACKALPOC), the kits' markers (P2S_OK, SHL_OK, NxSP…, ADV618BOUNDARY), the botnet's download URLs and servers, and PHPSESSID cookies carrying leaked memory (where cookies are logged)	High
	Addresses publicly reported attacking PHP2Shell (Amazon, Hunt.io, Arctic Wolf, and Wordfence's 20 busiest sources)	Medium
Temp folders	The botnet's second stage saved as nfs, nfs-setup, mountpoint or cCmono; critical for any program matching a published Potassium hash	High / Critical
	Programs (ELF files) in /dev/shm, or in /tmp since October 17; PHP files written to /tmp since October 17 (High when named like a kit's webshell)	High / Medium
Kit webshells	PHP files named wp2s.php, php2shell.php, php-to-shell…, autologin_fd.php, axiom_*.php (High) or tebaran_*.php (Medium); code printing P2S_OK/SHL_OK (High) or contacting the botnet's servers (Critical)	Critical / High / Medium
Server persistence	/etc/ld.so.preload loading a library into every program (a rootkit favourite)	High
PHP sessions	Session files containing PHP code (written by an attack, then included), or the kits' fixed session IDs and markers	High

Note

Patched PHP 8.4.27 and 8.5.12 log "Failed to decode session object" more often than before (php-src #24493). On a patched PHP the scanner treats that message as information only, not as a sign of attack.

wp2shell

Check	What it looks for	Severity
WordPress version	6.8 – 6.8.5, 6.9 – 6.9.4, 7.0 – 7.0.1	Critical / High → Vulnerable
Exploit plugins	wp2shell_<hex>, fake CMSmap, fake WP Static Cache Helper, gg- REST shells	Critical / High
Exploit leftovers	wp2shell_*.zip, wp2shell_<hex> staging folders, temp-write-test-* probes	Critical / High
	temp-write-test-… files WordPress itself made (the date is in the name): before July 17, 2026 → harmless leftover; after → worth a look	Low / Medium
REST backdoor	The morning/v1 namespace	Critical
Known files	SHA-1 hashes of published webshells	Critical
Access log	Successful (200/207) batch-API requests (even URL-encoded), exploit-tool user agents, attacker IPs, plugin uploads, admin enumeration	Critical → Medium

What either attack leaves behind

Check	What it looks for	Severity
Webshell code (whole site)	Code run straight from a request (eval, assert, system, passthru…), functions named by the request ($_GET['f'](https://github.com/CptNope/JAT-Shell-Scanner/blob/main/…)), packed eval(gzuncompress(base64_decode(…))), large base64 payloads, split ${'_P'.'OST'}, create_function with request input, including images as PHP, writing request data to disk, REST endpoints that run shell commands	Critical / High
	Request input + decoder + eval in one small file (some legitimate plugins do this)	Medium
PHP where it doesn't belong	PHP in uploads/, cache/, upgrade/, or loose in wp-content/ — High if changed since July 17, Medium if older, Low if it can't be run directly	High / Medium / Low
Images with PHP inside	<?php hidden in uploaded .jpg/.png/.gif… files	High
Hidden PHP	PHP files whose names start with a dot — in the site root or wp-content	High / Medium
PHP loaded into every page	auto_prepend_file / auto_append_file in .user.ini, .htaccess or php.ini (Wordfence's firewall is recognised)	High
Uploads .htaccess	Lines that make PHP executable in uploads (Wordfence's protective rules are recognised)	High
wp-config.php	Webshell code in it; edits since July 17	Critical / Low
Administrators	Admins created since July 17 (the one created at site setup is recognised)	High
	Existing or backdated accounts that became admins since the previous scan	High
	Application passwords added to admins since July 17	Medium
Roles	Non-admin roles given admin powers (install_plugins, edit_plugins, promote_users…)	Medium
Must-use plugins	Added or changed since July 17 (known host files only Low)	Medium / Low
Plugins	Folders of PHP hidden from the Plugins screen; loose single-file plugins; plugins updated since July 17	Medium / Low
Plugin files	Files of plugins from wordpress.org that differ from the official release's checksums (High); PHP files the release doesn't have (Medium); a plugin where most files differ — usually a Pro edition, but also what mass infection looks like (Medium). Plugins from elsewhere are skipped	High / Medium
Drop-ins	advanced-cache.php, object-cache.php, db.php, sunrise.php… added or changed since July 17 that don't name the plugin that made them (cache and database plugins are recognised)	Medium
Settings in the database	Code a backdoor can load: PHP that decodes or runs other code, scripts that decode and run hidden JavaScript, scripts built from character codes, scripts loaded from a bare IP address. Ordinary analytics snippets are fine	High / Medium
Posts and pages	Changed since July 17 with self-decoding scripts, invisible iframes, or blocks of links hidden from visitors (SEO spam). Embeds are fine	High / Medium
Scheduled tasks (WP-Cron)	Tasks whose arguments carry code (High) or download a script (Medium); random-looking task names nothing handles (Low)	High / Medium / Low
WordPress core	Files that differ from wordpress.org's checksums; unknown PHP in wp-admin/, wp-includes/ or the site root (old leftovers from manual updates are only Low)	High / Medium / Low
This scanner itself	Every file checked against the official release's fingerprints — attackers like to blind security tools	Critical / High

Built not to cry wolf. Every release is tested against WordPress core and some of the most-installed plugins — WooCommerce, Yoast SEO, Elementor, Jetpack, Contact Form 7, WP Super Cache, over 16,000 PHP files — and must produce zero High or Critical matches. Common legitimate files (cache plugins, Wordfence, Performance Lab, host must-use plugins, "Silence is golden" placeholders, WordPress's own update backups) are recognised.