JAT Shell Scanner

Free WordPress Scanner for PHP2Shell & wp2shell

---

A free, open-source WordPress plugin that tells you in about two minutes whether your site is exposed to PHP2Shell, the October 2026 attack on PHP itself, or wp2shell, the July 2026 attack on WordPress core, and whether anyone has already broken in. I built the first version the day after PHP2Shell was made public.

At a glance

• What: a free, open-source WordPress plugin (MIT license)
• Built: October 2026, solo. Version 1.0 shipped the day after PHP2Shell went public.
• Pace: nine releases in three days, now at version 1.5.1
• Stack: plain PHP for PHP 7.0 to 8.5 and WordPress 6.0+, about 6,800 lines, with WP-CLI commands and automated tests on every push
• Distribution: GitHub releases that update themselves, and submitted to the WordPress.org plugin directory as JAT Shell Scanner (in review)

The problem

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical bugs in PHP itself. They were made public on October 21, 2026, after being attacked since October 17. Anyone can run code on an unpatched server without logging in, and the bugs can leak passwords and keys from memory.

The fix is a PHP update, which is usually the host’s job. That leaves site owners unable to tell whether they are safe, because some Linux distributions ship the fix without changing the PHP version number. I maintain many WordPress sites and needed two answers for each one: is it exposed, and has anyone already got in?

Constraints

• It has to run on cheap shared hosting with short time limits.
• Scans may only read. Any fix has to be reversible.
• No account, no tracking and no paid tier, so anyone can use it during an active attack.
• False alarms are not acceptable. Clean WordPress core and popular plugins must produce zero High or Critical findings.

What it does

• Exposure check. Compares your PHP and WordPress versions with the fixed releases. On Ubuntu and Debian it reads the installed PHP package to spot fixes that don’t change the version number, and elsewhere it uses PHP’s build date.
• Attack traces. Looks for PHP2Shell’s tell-tale out-of-memory errors and worker crashes in the PHP error log, and optionally for exploit tools and suspicious batch-API requests in the access log.
• Break-in evidence. Known webshells and attacker plugin names, PHP hidden in uploads or images, a hidden REST backdoor, new or promoted admins, core files that don’t match wordpress.org, and code loaded into every page.
• Database backdoors. Code hidden in settings, scripts and hidden links injected into posts, and scheduled tasks that carry code.
• Plugin integrity. Checks plugins from WordPress.org against their official checksums, and flags unexplained drop-ins.
• Current threat intel. Indicators from Wordfence, Arctic Wolf and others are added as attacks evolve, such as the Potassium botnet’s second stage and the attack kits’ webshells and poisoned session files.
• One-click fixes with undo. Quarantine a flagged file or plugin, or remove an unknown admin’s rights, and restore either with one click. Scans themselves never change anything.
• Fleet dashboard. One hub site collects signed reports from all your other sites, worst first, with email, Slack or Discord alerts.
• Built for real hosting. Scans run in resumable slices on hosts with short time limits, weekly by default, and email only when something new and serious appears. Full WP-CLI support, Multisite and Site Health integration.

Get it: in WordPress, go to Plugins → Add New Plugin, search for JAT Shell Scanner, click Install Now and then Activate. Open Tools → JAT Shell Scanner to run your first scan. Updates arrive with your other plugin updates.

If your site can’t reach WordPress.org, download jat-shell-scanner.zip and upload it under Plugins → Add New Plugin → Upload Plugin.

On WordPress.org: submitted to the plugin directory on October 23, 2026 as JAT Shell Scanner. The directory doesn’t allow “wp” in plugin names. Once it’s approved, you’ll be able to install it from Plugins → Add New in WordPress.

GitHub repository: github.com/CptNope/JAT-Shell-Scanner. Source code, changelog, issues and every release are there. Suggestions for new indicators are welcome as issues or pull requests.

How it’s built

Plain PHP that runs on PHP 7.0 to 8.5 and WordPress 6.0 and newer, with no outside services except WordPress.org’s checksum lookups and any fleet hub, Slack or Discord alerts you set up yourself. The ignore list and fix records are signed with the site’s own secret keys, and the plugin checks its own files against the official release. Every push runs syntax checks on every PHP version from 7.0 to 8.5, about 90 integration checks against real WordPress installs (including vulnerable versions), and a false-positive test against more than 16,000 files from WordPress core and popular plugins that must produce zero High or Critical matches. Passing builds are released automatically, and installed copies update themselves from GitHub.

Nine releases in three days

• October 21: PHP2Shell is made public.
• October 22: version 1.0 ships, followed by 1.1 through 1.3.2 the same day as more attack details came out.
• October 23: version 1.4 adds a WordPress.org edition, built from the same code, and the plugin is submitted to the directory.
• October 24: version 1.5 adds scans of the database, plugin files and drop-ins. Version 1.5.1 adds the latest attack intel, including the Potassium botnet, attack-kit webshells, poisoned sessions and 34 more attacker addresses.

Results

• Every one of my own sites scanned clean: patched PHP and no signs of a break-in.
• It went from version 1.0 to a WordPress.org submission in one day.
• Anyone can now answer “am I exposed, and was I hit?” in about two minutes, for free.

Limits

It can’t stop PHP2Shell, which only a PHP update fixes, and it can’t see memory that was leaked. It finds known indicators, not every possible attack, and it isn’t a general antivirus.

Want to keep attackers out in the first place? JAT Site Shield is my free companion plugin for login protection, two-factor and hardening.