Title: JAT Shell Scanner Author: Jeremy Anderson Published: October 30, 2026 Last modified: October 30, 2026 --- Search plugins ![](https://ps.w.org/jat-shell-scanner/assets/banner-772x250.png?rev=3775582) ![](https://ps.w.org/jat-shell-scanner/assets/icon.svg?rev=3775582) # JAT Shell Scanner By [Jeremy Anderson](https://profiles.wordpress.org/cptnope/) [Download](https://downloads.wordpress.org/plugin/jat-shell-scanner.1.6.0.zip) * [Details](https://wordpress.org/plugins/jat-shell-scanner/#description) * [Reviews](https://wordpress.org/plugins/jat-shell-scanner/#reviews) * [Installation](https://wordpress.org/plugins/jat-shell-scanner/#installation) * [Development](https://wordpress.org/plugins/jat-shell-scanner/#developers) [Support](https://wordpress.org/support/plugin/jat-shell-scanner/) ## Description **PHP2Shell** (CVE-2026-109618 / CVE-2026-109619) is a pair of critical bugs in PHP itself, made public on October 21, 2026 and attacked since October 17. It lets anyone run code on an unpatched server without logging in, and can leak passwords and keys from memory. It’s fixed by updating PHP — usually your host’s job — to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. **wp2shell** (CVE-2026-63030 / CVE-2026-60137) is a WordPress core bug from July 2026, fixed in WordPress 6.8.6, 6.9.5 and 7.0.2. This plugin tells you whether your site is exposed to either, and looks for signs that an attacker already got in. Scans only read. If something is found, optional one-click fixes can quarantine files or remove admin rights — and every fix can be undone. JAT Shell Scanner is made by [Jeremy Anderson Tech](https://jeremyanderson.tech/)— the “JAT” in the name. #### What it checks * The PHP your website runs, including Debian/Ubuntu package versions and build dates (patched without a version change), and the temporary php.ini protections * Whether the site ran an unpatched PHP during the attack window * PHP2Shell traces in the PHP error log; exploit tools, known attacker addresses and suspicious bursts in the access log; the /tmp/nfs second stage * Your WordPress version, and wp2shell exploit plugins, files and traffic * Webshell code anywhere in the site, PHP hidden in uploads, images and the site root, and PHP auto-loaded via .user.ini / .htaccess * New or promoted administrators, roles given admin powers, application passwords * Backdoors kept in the database: code in settings, scripts and hidden links injected into posts, scheduled tasks that carry code * WordPress core files, and plugins from WordPress.org, against official checksums; unexplained drop-ins * Its own files, against the checksums WordPress.org publishes for this plugin #### Features * Works on shared hosting with short time limits — scans run in slices with a progress bar * A ready-to-send message for your host when PHP needs updating * Weekly or daily automatic scans with email alerts for new, serious findings * One-click quarantine and admin removal, with undo * Fleet dashboard: one hub site shows the results of all your sites, with email/ Slack/Discord alerts and remote rescans * Ignore false positives (signed, so attackers can’t forge it) * Site Health integration * WP-CLI: `wp jat-shell scan`, `status`, `ignore`, `fix`, `quarantine`, `fleet` * Multisite aware #### Free, open source, no account Everything in the plugin is free. There is no paid version, no sign-up and no tracking. Development happens in the open on [GitHub](https://github.com/CptNope/JAT-Shell-Scanner). #### Made by Jeremy Anderson Tech [Jeremy Anderson Tech](https://jeremyanderson.tech/) builds, secures and looks after WordPress sites. If you’d rather have someone deal with a vulnerable or hacked site for you, [book a call](https://jeremyanderson.tech/book-a-call/) or see the [services](https://jeremyanderson.tech/services/). Full documentation is on the [plugin’s page](https://jeremyanderson.tech/project/jat-shell-scanner/). ### External services The plugin only contacts outside servers in the cases below. It sends no analytics or personal data, and never sends your site’s files or scan results anywhere you didn’t set up. * **WordPress.org core checksums** (api.wordpress.org) — during a scan, to compare your WordPress core files with the official ones. Sends your WordPress version and locale, the same request WordPress itself makes. [WordPress.org privacy policy](https://wordpress.org/about/privacy/) * **WordPress.org plugin checksums** (downloads.wordpress.org) — during a scan, to check that this plugin’s files, and those of your other plugins from WordPress. org, haven’t been tampered with. Sends only each plugin’s folder name and version. Turned off with the “Core and plugin files” setting (except this plugin’s own self-check). [WordPress.org privacy policy](https://wordpress.org/about/privacy/) * **Your own fleet hub** — only if you turn on the fleet dashboard and connect a site to a hub you run (another WordPress site with this plugin). Requests are signed with your fleet key and a per-site key, and go only to the hub address you enter: - After each scan, a summary: site name and address, the address of its scanner page, verdict, WordPress, PHP and plugin versions, PHP’s server interface, scan time, finding counts, and the text of serious findings (email addresses removed). The first report also carries a random per-site key so the hub can recognise the site later. - Once an hour, a check-in with only the site’s address, asking whether someone on the hub requested a new scan. * **Slack or Discord** — only if you paste a webhook address into the fleet alert settings. The hub sends alert messages (site address and what was found) to that webhook. [Slack terms](https://slack.com/terms-of-service), [Discord terms](https://discord.com/terms) * **Email alerts** use your site’s normal WordPress mail. ## Screenshots [⌊The verdict: whether PHP and WordPress are exposed, and whether there are signs of a break-in.⌉⌊The verdict: whether PHP and WordPress are exposed, and whether there are signs of a break-in.⌉[ The verdict: whether PHP and WordPress are exposed, and whether there are signs of a break-in. [⌊Findings, with what each one means and what to do.⌉⌊Findings, with what each one means and what to do.⌉[ Findings, with what each one means and what to do. [⌊The fleet dashboard for many sites.⌉⌊The fleet dashboard for many sites.⌉[ The fleet dashboard for many sites. [⌊Quarantine: every fix can be undone.⌉⌊Quarantine: every fix can be undone.⌉[ Quarantine: every fix can be undone. ## Installation 1. Install from Plugins Add New Plugin (search for “JAT Shell Scanner”), or upload the zip, and activate. 2. Go to Tools JAT Shell Scanner and click Scan now. On multisite, network-activate and use Network Admin Settings JAT Shell Scanner. ## FAQ ### Will it change or delete my files? Scans never do. Only if you click a fix button does it move a file into quarantine or remove someone’s admin rights — and you can undo either from the Quarantine tab. Quarantined files go into the plugin’s own folder in uploads (uploads/jat-shell- scanner/), blocked from the web and renamed so they can’t run. ### It says “Vulnerable — PHP needs updating”. Was I hacked? Not necessarily. It means no signs of a break-in were found, but your server’s PHP can be attacked. Send your host the ready-made message on the scanner page. ### My host says PHP is patched, but the scanner disagrees. Some hosts fix PHP without changing its version number. If your host confirms both CVEs are fixed, click Ignore on that finding. ### Does it send my data anywhere? No. See “External services” above for the only outside requests it makes. ### I installed an earlier version from GitHub. The GitHub edition updates itself from GitHub releases. To switch to this WordPress. org edition, deactivate and delete the GitHub copy, then install this one. Deleting a plugin removes its settings, scan history and quarantine, so restore anything you need from the Quarantine tab and note your fleet settings first. ### Where do I report a bug or a new attack indicator? Use the [support forum](https://wordpress.org/support/plugin/jat-shell-scanner/). Security problems in the plugin itself: please report them privately through [GitHub](https://github.com/CptNope/JAT-Shell-Scanner/security/advisories/new). ## Reviews There are no reviews for this plugin. ## Contributors & Developers “JAT Shell Scanner” is open source software. The following people have contributed to this plugin. Contributors * [ Jeremy Anderson ](https://profiles.wordpress.org/cptnope/) [Translate “JAT Shell Scanner” into your language.](https://translate.wordpress.org/projects/wp-plugins/jat-shell-scanner) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/jat-shell-scanner/), check out the [SVN repository](https://plugins.svn.wordpress.org/jat-shell-scanner/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/jat-shell-scanner/) by [RSS](https://plugins.trac.wordpress.org/log/jat-shell-scanner/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.6.0 * Renamed to JAT Shell Scanner (by Jeremy Anderson Tech). * Quarantine now lives in the plugin’s own folder in uploads (uploads/jat-shell- scanner/) instead of wp-content. Files quarantined by earlier GitHub builds can still be restored or deleted. * Finds every folder through WordPress’s own functions, so sites with moved content, plugin or theme folders are scanned correctly, including theme folders registered elsewhere. * Fleet reports are checked in the REST permission check. * Requires WordPress 6.2 or newer. #### 1.5.1 * Latest PHP2Shell intel: the Potassium (Mirai) botnet’s second stage, servers and download names; webshell names and markers from PHP2Shell exploit kits; poisoned session files; Apache worker aborts; 34 more attacker addresses. * Advice for CVE-2026-115560, a related PHP flaw with no fix yet: turn off session upload progress. #### 1.5.0 * Looks for backdoors in the database: code stored in settings, self-decoding scripts, invisible frames and hidden links in posts, and scheduled tasks that carry code or download scripts. * Checks plugins from WordPress.org against their official checksums, catching a backdoor written into a real plugin’s file and stray PHP files in plugin folders. * Flags drop-ins (advanced-cache.php, object-cache.php, db.php…) changed since the attacks that don’t say which plugin made them. #### 1.4.0 * Now available on WordPress.org. The WordPress.org edition updates through WordPress. org and checks its own files against WordPress.org’s checksums. * Links to documentation, support and the author on the Plugins screen and the scanner page. * The update check no longer sends the site address to GitHub. #### 1.3.2 * Recognises the Installatron Worker (it-api.php), the temporary script IONOS and other hosts use for one-click installs. * Hidden “data” files that can only answer 404 are no longer reported as backdoors. The full history is in [CHANGELOG.md](https://github.com/CptNope/JAT-Shell-Scanner/blob/main/CHANGELOG.md). ## Meta * Version **1.6.0** * Last updated **24 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 7.0 or higher ** * Tags * [malware](https://wordpress.org/plugins/tags/malware/)[scanner](https://wordpress.org/plugins/tags/scanner/) [security](https://wordpress.org/plugins/tags/security/)[vulnerability](https://wordpress.org/plugins/tags/vulnerability/) [webshell](https://wordpress.org/plugins/tags/webshell/) * [Advanced View](https://wordpress.org/plugins/jat-shell-scanner/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/jat-shell-scanner/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/jat-shell-scanner/reviews/) ## Contributors * [ Jeremy Anderson ](https://profiles.wordpress.org/cptnope/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/jat-shell-scanner/)