JAT Shell Scanner

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical bugs in PHP itself, made public on October 21, 2026 and attacked since October 17. It lets anyone run code on an unpatched server without logging in, and can leak passwords and keys from memory. It's fixed by updating PHP — usually your host's job — to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. wp2shell (CVE-2026-63030 / CVE-2026-60137) is a WordPress core bug from July 2026, fixed in WordPress 6.8.6, 6.9.5 and 7.0.2. This plugin tells you whether your site is exposed to either, and looks for signs that an attacker already got in. Scans only read. If something is found, optional one-click fixes can quarantine files or remove admin rights — and every fix can be undone. JAT Shell Scanner is made by Jeremy Anderson Tech — the "JAT" in the name. What it checks

• The PHP your website runs, including Debian/Ubuntu package versions and build dates (patched without a version change), and the temporary php.ini protections
• Whether the site ran an unpatched PHP during the attack window
• PHP2Shell traces in the PHP error log; exploit tools, known attacker addresses and suspicious bursts in the access log; the /tmp/nfs second stage
• Your WordPress version, and wp2shell exploit plugins, files and traffic
• Webshell code anywhere in the site, PHP hidden in uploads, images and the site root, and PHP auto-loaded via .user.ini / .htaccess
• New or promoted administrators, roles given admin powers, application passwords
• Backdoors kept in the database: code in settings, scripts and hidden links injected into posts, scheduled tasks that carry code
• WordPress core files, and plugins from WordPress.org, against official checksums; unexplained drop-ins
• Its own files, against the checksums WordPress.org publishes for this plugin

Features

• Works on shared hosting with short time limits — scans run in slices with a progress bar
• A ready-to-send message for your host when PHP needs updating
• Weekly or daily automatic scans with email alerts for new, serious findings
• One-click quarantine and admin removal, with undo
• Fleet dashboard: one hub site shows the results of all your sites, with email/Slack/Discord alerts and remote rescans
• Ignore false positives (signed, so attackers can't forge it)
• Site Health integration
• WP-CLI: wp jat-shell scan, status, ignore, fix, quarantine, fleet
• Multisite aware

Free, open source, no account Everything in the plugin is free. There is no paid version, no sign-up and no tracking. Development happens in the open on GitHub. Made by Jeremy Anderson Tech Jeremy Anderson Tech builds, secures and looks after WordPress sites. If you'd rather have someone deal with a vulnerable or hacked site for you, book a call or see the services. Full documentation is on the plugin's page.

1. Install from Plugins → Add New Plugin (search for "JAT Shell Scanner"), or upload the zip, and activate.
2. Go to Tools → JAT Shell Scanner and click Scan now.

On multisite, network-activate and use Network Admin → Settings → JAT Shell Scanner.

1.7.0

• Far fewer false alarms from newly installed plugins and hosts. These are now recognised instead of reported as a break-in: PHP a plugin keeps in its own uploads or cache folder, updates left half-unpacked in wp-content/upgrade, must-use files and drop-ins that only load an installed plugin, security firewalls (Wordfence, All In One WP Security, MalCare) at the site root, and host security tools that load before every page. Anything still worth a look is "needs review", not "suspicious".
• Ordinary plugin code no longer matches webshell signatures: a method named exec() or system(), or saving custom CSS from a form.
• New PHP2Shell indicators from honeypot captures (October 22–24): probe markers, webshell names (shell_<8 letters>.php), session IDs and attacker addresses.
• New wp2shell persistence indicators from an incident report: fake plugin folders, w2s_/wpsvc_ admin accounts, a hidden option, and marked wp-config.php and .htaccess blocks.
• Reminds sites to install WordPress's October 28, 2026 security release (7.1.4, 7.0.8, 6.9.11…), which fixes a race condition during core updates that could allow remote code execution.

1.6.0

• Renamed to JAT Shell Scanner (by Jeremy Anderson Tech).
• Quarantine now lives in the plugin's own folder in uploads (uploads/jat-shell-scanner/) instead of wp-content. Files quarantined by earlier GitHub builds can still be restored or deleted.
• Finds every folder through WordPress's own functions, so sites with moved content, plugin or theme folders are scanned correctly, including theme folders registered elsewhere.
• Fleet reports are checked in the REST permission check.
• Requires WordPress 6.2 or newer.

1.5.1

• Latest PHP2Shell intel: the Potassium (Mirai) botnet's second stage, servers and download names; webshell names and markers from PHP2Shell exploit kits; poisoned session files; Apache worker aborts; 34 more attacker addresses.
• Advice for CVE-2026-115560, a related PHP flaw with no fix yet: turn off session upload progress.

1.5.0

• Looks for backdoors in the database: code stored in settings, self-decoding scripts, invisible frames and hidden links in posts, and scheduled tasks that carry code or download scripts.
• Checks plugins from WordPress.org against their official checksums, catching a backdoor written into a real plugin's file and stray PHP files in plugin folders.
• Flags drop-ins (advanced-cache.php, object-cache.php, db.php…) changed since the attacks that don't say which plugin made them.

1.4.0

• Now available on WordPress.org. The WordPress.org edition updates through WordPress.org and checks its own files against WordPress.org's checksums.
• Links to documentation, support and the author on the Plugins screen and the scanner page.
• The update check no longer sends the site address to GitHub.

1.3.2

• Recognises the Installatron Worker (it-api.php), the temporary script IONOS and other hosts use for one-click installs.
• Hidden "data" files that can only answer 404 are no longer reported as backdoors. The full history is in CHANGELOG.md.