外掛標籤
開發者團隊
原文外掛簡介
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical bugs in PHP itself, made public on October 21, 2026 and attacked since October 17. It lets anyone run code on an unpatched server without logging in, and can leak passwords and keys from memory. It’s fixed by updating PHP — usually your host’s job — to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
wp2shell (CVE-2026-63030 / CVE-2026-60137) is a WordPress core bug from July 2026, fixed in WordPress 6.8.6, 6.9.5 and 7.0.2.
This plugin tells you whether your site is exposed to either, and looks for signs that an attacker already got in. Scans only read. If something is found, optional one-click fixes can quarantine files or remove admin rights — and every fix can be undone.
JAT Shell Scanner is made by Jeremy Anderson Tech — the “JAT” in the name.
What it checks
The PHP your website runs, including Debian/Ubuntu package versions and build dates (patched without a version change), and the temporary php.ini protections
Whether the site ran an unpatched PHP during the attack window
PHP2Shell traces in the PHP error log; exploit tools, known attacker addresses and suspicious bursts in the access log; the /tmp/nfs second stage
Your WordPress version, and wp2shell exploit plugins, files and traffic
Webshell code anywhere in the site, PHP hidden in uploads, images and the site root, and PHP auto-loaded via .user.ini / .htaccess
New or promoted administrators, roles given admin powers, application passwords
Backdoors kept in the database: code in settings, scripts and hidden links injected into posts, scheduled tasks that carry code
WordPress core files, and plugins from WordPress.org, against official checksums; unexplained drop-ins
Its own files, against the checksums WordPress.org publishes for this plugin
Features
Works on shared hosting with short time limits — scans run in slices with a progress bar
A ready-to-send message for your host when PHP needs updating
Weekly or daily automatic scans with email alerts for new, serious findings
One-click quarantine and admin removal, with undo
Fleet dashboard: one hub site shows the results of all your sites, with email/Slack/Discord alerts and remote rescans
Ignore false positives (signed, so attackers can’t forge it)
Site Health integration
WP-CLI: wp jat-shell scan, status, ignore, fix, quarantine, fleet
Multisite aware
Free, open source, no account
Everything in the plugin is free. There is no paid version, no sign-up and no tracking. Development happens in the open on GitHub.
Made by Jeremy Anderson Tech
Jeremy Anderson Tech builds, secures and looks after WordPress sites. If you’d rather have someone deal with a vulnerable or hacked site for you, book a call or see the services. Full documentation is on the plugin’s page.
External services
The plugin only contacts outside servers in the cases below. It sends no analytics or personal data, and never sends your site’s files or scan results anywhere you didn’t set up.
WordPress.org core checksums (api.wordpress.org) — during a scan, to compare your WordPress core files with the official ones. Sends your WordPress version and locale, the same request WordPress itself makes. WordPress.org privacy policy
WordPress.org plugin checksums (downloads.wordpress.org) — during a scan, to check that this plugin’s files, and those of your other plugins from WordPress.org, haven’t been tampered with. Sends only each plugin’s folder name and version. Turned off with the “Core and plugin files” setting (except this plugin’s own self-check). WordPress.org privacy policy
Your own fleet hub — only if you turn on the fleet dashboard and connect a site to a hub you run (another WordPress site with this plugin). Requests are signed with your fleet key and a per-site key, and go only to the hub address you enter:
After each scan, a summary: site name and address, the address of its scanner page, verdict, WordPress, PHP and plugin versions, PHP’s server interface, scan time, finding counts, and the text of serious findings (email addresses removed). The first report also carries a random per-site key so the hub can recognise the site later.
Once an hour, a check-in with only the site’s address, asking whether someone on the hub requested a new scan.
Slack or Discord — only if you paste a webhook address into the fleet alert settings. The hub sends alert messages (site address and what was found) to that webhook. Slack terms, Discord terms
Email alerts use your site’s normal WordPress mail.